One of the things I like about Google's Android operating system is that it's an open platform. Anyone can write an application and, unlike Apple's tight hold on iPhone and iPod apps, you don't need Google's permission to distribute an app in the Android marketplace.
Yet there is a potential downside to such openness. Without a "big brother" to vet applications, there is a greater possibility of improperly written and ill-behaving programs, programs that compromise user privacy and just plain malicious software designed to corrupt your device or steal your information.
A recent report from SMobile Systems suggests that these concerns are not without merit. The security company performed a "threat analysis" that "indicates that there are thousands of applications that exist in the market that grant access to personal information, location data or access to services that could be used for nefarious purposes."
While the report concludes that "a majority of these applications were written with the best of intentions" and are unlikely to compromise user data, it nevertheless paints a relatively scary picture of the potential threat of errant mobile phone apps.
The report said about 20 percent of the 48,000 apps "request permission to access private or sensitive information that an attacker could for malicious purposes."
SMobile produces security software for mobile devices and has a vested interest in raising concerns, but that doesn't mean we should ignore the warnings.
SMobile points out that the Android Marketplace relies on users to report applications that malfunction or are malicious, and it's certainly true that a community policing model can be effective in helping to identify dangerous apps.
But because it's an after-the-fact methodology, the company argues that there will always be a window between when an app is released and when its dangers have been identified and the app removed from the market. During that window, unsuspecting users could wind up being harmed.
The report cites the example of "Droid 09," a phishing application that said it would allow Android users to conduct banking activities from their phone. It's not clear what, if anything, the app did with banking credentials but it certainly raised concern among online banking professionals.
Via e-mail, a Google representative said the "report falsely suggests that Android users don't have control over which apps access their data. Not only must each Android app gets users' permission to access sensitive information, but developers must also go through billing background checks to confirm their real identities, and we will disable any apps that are found to be malicious."
And in a telephone interview, Google spokesman Jay Nancarrow said "the Android team was aware of what it would mean to not have a formal vetting process" and that the company relies on user feedback and a rating system. He said Google wanted to make sure it was "keeping innovation flowing" by not putting up too many barriers for developers.
In addition to knowing your location, the SMobile report said that applications can also get permission to initiate a phone call, get a list of the accounts associated with your phone, access the Internet, monitor, modify or abort outgoing calls, read the user's calendar data, read contact lists, read data about the phone's owner, read text messages, send or receive text messages.
Know What You're Permitting
The main issue is that many Android applications ask permission for certain privileges such as access to the user's GPS location data, the ability to access the Internet or, in some cases, access to the user's contact list. And while users have the ability to deny access, SMobile Chief Technology Officer Dan Hoffman said in an interview that users often grant those permissions without fully understanding what they are permitting the application to do.
"The majority of users don't look at it. They say, 'I don't know what it means and maybe I care, maybe I don't, but it's not going to stop me from installing the application.' "
He also said the issue applies to other smartphones but worries that the problem could be worse with Android. "When it comes from a developer who developed it in their basement and there's no vetting process, then that should be concerning to users."
When I download apps on Android or on the Apple App store, I do look at the permissions they request and think about whether they make sense in terms of what the app does. For example, if you were to download an app like Glympse or Foursquare -- which are designed to enable you to share your location -- it would make perfect sense to permit those apps to know your location, but if it were an app that had no obvious reason to know your location, you might want to think twice before enabling it.
Security vs. Freedom
There is always going to be a battle between security and freedom. Apple's tight control over iPhone apps probably does help protect customers by assuring that apps are working properly and behaving ethically, but there is a cost associated with that as well. Some perfectly safe apps have been rejected and some developers have accused Apple of rejecting apps for business reasons.
Google's more open process feels a lot more democratic but, like democracy itself, requires a bit more vigilance on the part of its "citizens."
Follow Larry Magid on Twitter: www.twitter.com/larrymagid
Also, where is the companion analysis of the iPhone marketplace? I searched sMobile's site and could not find one. My guess is that an independent analysis is not possible due to the completely closed nature of Apple's app infrastructure.
In reality, neither Apple nor Google can guarantee that the apps being offered to users are free of security vulnerabilities or malware. In the end it falls on the user to apply common sense when deciding what apps they install.
The thing is though, that no matter how much Google may police or over-police its marketplace, Android ALWAYS gives you the option to install outside the marketplace and you don't have to root or hack your phone to do it.
That is why power users look to Android even with its security problems. Common sense tells you not to install a random bank app and start entering your account information. There are almost a dozen different sites that catalog and rate Android apps, if you are unsure of an App do a little snooping around before you go installing.
Just use the same discretion as you would on your PC or Mac and you will be fine.
1. Function as a wifi hub to power your other devices with internetz
2. Run classic game emulators up to PS1/N64
3. Personalize the home environment with animated wallpaper
4. Have some mildly offensive apps that shouldn't bother anyone who isn't sexually repressed.
5. Use a true browser other than safari.
6. Connect any bluetooth device I feel like including wiiMotes to play said classic games
7. Run the google voice app
8. Truly multi-task whatever apps i please.
OK, devs get on that list!
.
Wait it's all already been done? Great!
.
Oh s*** all that functionality was already in the app store but has been thrown out?
.
Wait, you can do all of that on Android without having to hack your phone? Sign me up.
(That was pretty much my exact thought process when I first was considering the iPhone)
The cited white paper is very interesting, but does not reveal anything that the security community did not already know (although it is important that the wider community is aware of these points). What is really needed here is a comparative analysis of malicious apps that have appeared over time over the two phones.
I want Macafee to do that...
Or did you mean something else?
If my macs have never been laid up by virusues, but my PCs have, which brand has experienced greater security?
It's not just about the walls; it's about the incentive to breach them.
http://www.zdnet.com/blog/security/pwn2own-2010-iphone-hacked-sms-database-hijacked/5836
Follow this competition to really see what's what with security, it's a hacking contest.
http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010
Macworld talks about viruses regularly, and how to avoid them.
bring on the hate and idiocy.
Read up:
http://dvlabs.tippingpoint.com/blog/2008/03/27/day-two-of-cansecwest-pwn-to-own---we-have-our-first-official-winner-with-picture
from this alone i can tell your not very bright.
Larry