Slashdot Mirror
Google App Verification Service Detects Only 15% of Infected Apps
ShipLives writes "Researchers have tested Google's app verification service (included in Android 4.2 last month), and found that it performed very poorly at identifying malware in apps. Specifically, the app verification service identified only ~15% of known malware in testing — whereas existing third-party security apps identified between 51% and 100% of known malware in testing."
Much like Windows Defender. Or in the case of Window 8, Window Defender.
...Steve
chances are that Lookout and others have already patented their methods and google should just use their work for free and then call them patent trolls and how their inventions are totally obvious
Whew luckily no problem here, my motorola defy has so much crapware in the rom, almost as bad as a windows PC, that is so out of date that it's all got updates (now wasting twice the memory) that I don't have to worry about "apps" because I have no space to download apps after installing a very basic set of apps (dropbox, kindle reader, tunein radio, evernote, runkeeper, that kind of can't live without it stuff)
Probably google would make a heck of a lot more money forcing mfgrs to make it possible for users to download apps, than they would by trying to make clean apps that I can't afford to download anyway.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
I wonder, what's the false positive rate on these "third-party" systems? It's easy to make a system that detects 100% of malware as malware - just deny everything.
What? 2000, maybe? More specifically, they're part of the test cases of virus writers, who develop until they are circumvented. Why would anyone imagine they do anything useful?
McAfee would kill for that.
Well, it's a good thing there are 3rd party options.
I don't want/need additional bloat on my phone - I don't install random apps, and I'm quite comfortable wiping the phone to update it. Sure, I'll use a scanner if/when I start installing random things, but it's basic online hygene. I don't install random programs on my computer, but I do use a 3rd party antivirus because of all the browsing I do. That isn't something I do on my phone, and when it is, I will take the appropriate precautions.
- Nec Impar Pluribus, or so I'm told.
The "researchers" tested the service a few days after it's release, and compared it with other similar apps that had months, if not years time to polish and get up to date?
Will they follow up in 6 months? Doubtful, since the results would put Google near the lead, and this article looks like anti-Google.
What happened to researchers these days? Where's the objectivity?
The malware developers test and try to circumvent the Google scanner and don't bother with third-party security apps. If Google buys an app with 100% detection rate and uses it in their scanner, guess what the detection rate will be a few months later.
n/t
I swear to God...I swear to God! That is NOT how you treat your human!
Can't expect something that operates in this manner to have a high detection rate - it's another layer that provides a benefit. It's a win in my book. The failing of this system, IMO, is that it requires user intervention. As we all know, and has been shown with the advent of technology for the masses, people will just click "ok" to get past warning messages - without reading them. It's a start, though!
Because we all 'know' that business is about making money, the 'effort' on Google's part would seem counterproductive anyway, right?
I wonder if this is the correct term: "infected" means that the author had written a benign application, while an attacker somehow got control over his distribution channel and modified the app to his needs. Meanwhile, I believe that in a significant number of cases cheap apps are written and distributed by malicious authors. So yep, they're dangerous, and no, they're neither infected nor otherwise modified.
So who detected the remaining 85% in order to give us this statistic of 15% detection rate? And why isn't that being used instead?
No sig for you. YOU GET NO SIG!
Does any of the mentioned "existing third party products" really DETECT malware? Or do they only check apks against lists of manually compiled checksums?
bickerdyke
It detects 15% of malicious apps, which would otherwise go undetected. Thats better than not having this service.
So what will you do when your Apple device doesn't just work?
And then you link to a story about ONE app that uploaded an address book somewhere. That was it.
How is that Malware? At best it's spyware. And it wouldn't even be able to do that under iOS6 without asking for permission to access contacts.
Meanwhile probably 25 of Android software is scraping your contacts but who cares about that? It's just expected on Android that most apps will violate you somehow I guess.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
100 percent.
I don't want or need it either. I have an iPhone.
... and virtually no flexibility. Browser choice? HA. Oh wait, you can jailbreak? Congrats, there goes your warranty. Honestly, apple users are starting to protest just a little too hard to be credible.