Slashdot Mirror
Google: Less Than One Percent of Android Devices Are Affected By Harmful Apps
jfruh writes: One of the selling points of iOS is that its more restrictive nature makes it more secure. But even though it's easier for users to accidentally install malicious apps on Android, data collected by Google (PDF) indicates that less than one percent of Android users have actually done so. Quoting: "During October 2014, the lowest level of device hygiene was 99.5% and the highest level was 99.65%, so less than 0.5% of devices had a Potentially Harmful Application (PHA) installed (excluding non-malicious Rooting apps). During that same time period, approximately 0.25% of devices had a non-malicious Rooting application installed. ... Worldwide, excluding non-malicious Rooting applications, PHAs are installed on less than 0.1% of devices that install applications only from Google Play. Non-rooting PHAs are installed on approximately 0.7% of devices that are configured to permit installation from outside of Google Play. Additionally, the second graph shows devices with any PHA (including Rooting applications). Rooting applications are installed on about 0.5% of devices that allow sideloading of applications from outside of Google Play."
AppOps, tyvm. Done.
Bye!
A lot.
If Google or Apple talk stats about their ecosystem, take it with a giant grain of salt.
It's pure marketing BS.
If it was possible to identify all the PHAs antivirus would still be 100% effective. Not to mention the varying definitions of 'harm.' For instance, i consider all the apps wanting to take my IMEI harmful, and I doubt Google counted these as 'potentially harmful'.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
the great Short Attention Span Company(tm) EOLs phones like there's no tomorrow. my older google phone is stuck at android 2.x and will never get updates. I don't care about features, but I'd like kernel, ip-stack and some onboard apps to have fixes for security.
it won't ever happen. we don't really own our phones. and we are suppose to keep landfilling perfectly fine hardware - to keep the monsters in high profit.
even if I ran no apps at all, the os is buggy and full of weaknesses. I'm sure I could be attacked with an old 2.2 android os, probably in just a few minutes time.
this is why I hate phones and have zero interest in spending more money and time on this crap. the ceo's might have gotton it right: use dumb feature phones and be more secure!
--
"It is now safe to switch off your computer."
Even .1% of a billion devices, is still a lot of devices affected. Even that is still a very conservative number: lowest rate listed and a very small number of devices. This says there are ~1.6 billion phones (http://www.statisticbrain.com/android-phone-statistics/), which doesn't include tablets or any other devices. So percent-wise .1% sounds great... but numbers-wise I hope they get that percent even smaller ;) Just saying...
While I have seen a lot of viruses on Windows PCs, I have never seen an Android "harmful app" or virus. They probably exist, but I tend to believe that they are only installed on less than 0.5% of Android phones.
I've seen a lot of crapware with too much permissions and lots of ads, just like on iOS, but nothing the user didn't agree with.
Soon enough, all these apps will be forgotten and replaced by better alternatives, just like nobody still use WinZip or any other file archiver with a nag screen.
All of the Android phones I've owned had huge space limitations (can not install to the SD card) which keeps me from installing and playing with many potentially dangerous apps. Hey, Google, why can't I install apps to my SD card?
Some things need to be said...
There might be twice as many Android users out there, but iOS accounts for 85% of the revenue collected from apps.
There might be less than one percent Android users that are running around with infected phones, but there's nearly half a billion iPhone users and thanks to Apple's business model there's zero known infected phones. The only way to infect your iPhone is to jailbreak it first, then you can install whatever malware you want.
It's fun to imagine other industries coming out with such nonsense statements. Less than one percent of our cars sometimes drive off a cliff on their own. Less than one percent of our televisions watch pay per view automaticly. Less than one percent of our airplanes sometimes run into buildings. Less than one percent of our prostitutes have STDs. Less than one percent of our staff will steal your identity and your stuff.
I see that their definition of "potentially harmful app" doesn't include those which send whatever personal data they can get access to into the "cloud". IMHO there are hardly any Android apps that are not potentially harmful, except those in the open source F-droid.org "app store". Of the top 40 apps in the Google app store, only Avira Antivirus and WhatsApp don't have one of the ad trojans embedded, but of course one is snake oil and the other is an app that only an exhibitionist wouldn't find offensive.
Google: Less Than 10 Million of Android Devices Are Affected By Harmful Apps Doesn't sound so nice now does it
http://Anveto.com - Web Design, SEO, Marketing, Analytics & Security
Rooting applications are installed on about 0.5% of devices that allow sideloading of applications from outside of Google Play.
When an article (and a summary) include garbage like this, I refuse to take the rest seriously. Rooting is not Sideloading. There is a feature right in every stock Android system that tells Android that it is OK to accept Apps from sources other than Google. There are apps included with factory fresh Android that will install these apps as long as the user has chosen to allow it. This is how things like the Amazon app store work, which I have on every one of my Android devices even though none of them are rooted.
If the article can't get this right, and I know it is wrong, then I don't even want to risk exposure to bad information that I might not know enough to reject.
I'm an American. I love this country and the freedoms that we used to have.
If one is is interested in privacy then the continuous monitoring by Google is clearly a malicious invasion of it. This is built into the core of Android though, so there aren't many good alternatives other than to avoid it altogether.
A halfway house is to avoid some of Android's insecurity by design and and the privacy leakage of Google Play by installing only free and open source apps from F-droid. While this can provide some confidence that apps are not phoning home and other malicious things, it does nothing about the core operating system itself. Big Brother Google is still in charge.
Maybe one day Schmidt will have his Android device hacked and will then tell Google techs that they have to do something about Android security, especially add a firewall and jail all apps in individual Linux containers.
What he's never going to do though is to give users total control over what applications can do post-installation, because their lack of control is what empowers app developers and hence brings in Google profits. That conflict of interest is at the heart of Android's security/privacy problems.
it now takes 6 minutes for my tablet to become usable after i open the lid.
Thanks android patch :P
95% of the brand A cars build in the last 10 years are still one road, does not mean brand A cars have a 95% chance of lasting 10 years. Only 10% of the cars built over the last 10 years is likely to be 10 years old. So they could be talking of just 50-50 chance of their cars lasting 10 years.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
1% of (assuming by now) billions of devices is a lot of compromised devices.
An app that you don't want, is completely useless, that consumes storage space, but is not removable - that, to me, is harmful. By that measure, 99.9% of Android phones contain harmful apps.
Just wait until one of the cannot-be-uninstalled apps comes up with a major security vulnerability. That's going to be fun to watch.
As of June 2014 there were 1 billion active Android users.
That makes 1% equal to [drum roll] 10 million devices as of 10 months ago, so the current number is bigger. That's NOT an insignificant number, Google. Do something!!!
What do they actually count? When a device was compromised, the attackers should cover their tracks and the device should be difficult to identify as being compromised.
In other words, there is no "compromised' flag to easily identify on devices. Which leads to the question: what does Google's number mean?
Yea....that data is coming from Google who has a history of lying! Yea I believe that! 97% of the malware is for android and most android users are on older devices without patches on them and some bugs Google refuses to fix! Please sell me another lie!
"Phone status" sounds like it is about the current status, but actually that exposes all the numbers you call, when, for how long, etc.
Perhaps it's just to give the app advance notice to autosave the user's unsaved work in case the app gets forcibly OOM-killed by the dialer app on an underpowered device. The problem is with Android itself: the permission for "tell when the phone is ringing" is conflated with too many other capabilities.
And the same app will ask for full network access, even though if you look at the traffic, almost all of them are using HTTP to talk to their services
Your app still needs "full network access" if you want it to do anything other than open web pages in a web browser. Or were you planning on opening a web page in a web browser to send the data to the server and then having the server redirect the browser back to a custom URL scheme that sends the data back to your application? That'd certainly be a circuitous route just to avoid a permission.
If not through advertisement, then how do you expect a developer to recoup the cost of developing an application for distribution without charge?
Even if that number is correct that goes by google's definition. I'd say many of the apps in their own store are harmful because they ask for too many permissions and you have little you can do about it thanks to google's all or nothing approach to permissions.
Also, the whole platform requires you to assume you can be interrupted at any time. This is almost entirely mitigated by the API giving you a sqlite database to store all your crap in. It will still be there.
Would it be prudent for the application to COMMIT the SQLite database after every single character the user types, every single brush stroke in a drawing program, or every frame of a real-time video game, just in case the backend is killed by force? If not, what would be an appropriate compromise?
The only app that needs to know the phone state is a dialer app
Another problem conflated with "phone state" is whether the user is connected to the Internet at all. Say an application is designed to retrieve data from the Internet when the user happens to be momentarily connected to the Internet. Checking every minute would waste battery. So how should an app request to be notified when an Internet connection becomes available? Or is the application's developer expected to operate a server that acts as a proxy to perform this polling process and then send push notifications through Google Cloud Messaging to the application?
Also, no, you don't need "full network access" to access anything outside a web browser. You only need it to go off port 80 HTTP.
For one thing, where is this documented? Google android http without internet permission didn't appear to turn up anything relevant. For another, "port 80 HTTP" allows a passive attacker to view private information being passed between the client and the server and an active attacker to change said information. Does port 443 HTTPS require "full network access"? If not, then where is this documented?
A key thing to understand is that checking if the OS says a connection is up doesn't mean your connection will succeed or that there is really a real connection.
I'm aware of that. I just wanted to find a way for the app to know when it is worthwhile to spend the device's battery charge on attempting to sync.
The way to find out if you can connect is by connecting.
Every five seconds? If not, then how often?
That is the same as on a desktop computer.
The key difference is that unlike a mobile device, a desktop computer has essentially unmetered energy. In addition, a desktop computer's Internet connection is far more likely to be always-on, unlike a laptop or tablet that gets used in a moving vehicle.
And maybe they're happy with it trying again after a minute.
If the app keeps "trying again after a minute" for four hours, some people might argue that that's 240 wakeups too many.