A few recent incidents have called attention to the risks involved with downloading applications from the Android Market. Malicious software has been affecting personal computers for years but programs such as trojans and phishing applications are just starting to make an appearance on Android smartphones. For example, late in 2009 an individual created numerous applications purporting to be from credit unions and banks. Instead, these were phishing attempts to gain access to peoples’ bank accounts. In July 2010, an application which appeared to be a tip calculator was instead spyware which sent transcripts of text message conversations to a third party. A trojan application, discovered about the same time as the tip calculator, was disguised as a media player but in reality sent text messages to premium services which then billed the phone’s owner.
Unlike the iPhone, applications for Android smartphones are not screened in advance. Instead, the marketplace relies on a system of user comments, ratings, and flagging of suspicious applications. There is no central authority regulating what applications are allowed, and therefore presumed safe, to be placed in the Android Market. The emphasis is on the reputation an application gains after being tried by thousands of users and disclosure of information about what potentially unsafe actions the application is permitted to perform. You can use this information to protect yourself when choosing applications to download.
Google does have the ability to remove malicious applications from the market and even from users’ phones. This has been used on a few occasions. There are also anti-malware applications starting to appear for Android but it may take a while before their effectiveness is proven. Even with these types of safeguards the first line of defense will continue to be your evaluation of the applications using the criteria outlined below.
First, each application has a rating of one to five stars. This is visible on the Android Market’s search listing screen, so it is one of the first things visible as you are looking for an application. Just because an application has a low rating doesn’t mean it’s malicious; it could just be not very functional or popular. But a low rating is an indication that you should be wary. If there is no rating shown at all then no one has rated the application yet. This could be because it is brand new or nobody has chosen to give it even a single star rating. In either case, these applications should be treated with much caution.
After selecting an application from the search listing, a page showing details of the application is displayed. The first thing on the page is a description of what the application does. Is this description well written and does it describe what you’re looking for in the application? This may be an indicator of the quality of the application and its applicability to your needs.
Below the description there is a line which shows the number of downloads and ratings. This can be used to gauge the validity of the star rating. A rating of four stars for an application which has several thousand ratings should be viewed as a more reliable rating than that of a five star application with less than ten ratings, all of which could have been added by the developer.
Near the bottom of the About tab there is a section for contact information for the developer. Is there a website listed? If so, does the website look legitimate? If the application claims to be from a major company, such as a bank, does the contact information match that of the institution and, more importantly, does the company’s website actually contain references to the application? While lack of a website is not necessarily an indicator of a malicious application, if the contact information doesn’t make sense then this should be a red flag.
The next thing to look at is the Comments tab. Here you will find the latest comments and ratings people have made regarding the application. By scanning down this list you may find recent issues or concerns which have arisen even regarding the most reputable applications. These comments may not necessarily revolve around security issues. You may also find notes indicating issues with the application on your particular device or bugs which have been discovered in the latest release.
Also make sure you’ve looked at the price and currency of the application. The Android Market does make it obvious that you are about to buy an application rather than download one for free but it can be easy to be fooled by a price listed in a foreign currency. This could lead to paying more than you expected in addition to currency conversion fees.
The last thing to check, only because the information isn’t shown until you press the Install or Buy button, is the system permissions the application requires, if any. There is a long list of actions that an application requires permission from you for before it can perform them on your smartphone. These include things like accessing the SD card, making phone calls, using the Internet, and accessing your GPS coordinates. There’s even a system permission for completely disabling, also called “bricking”, the phone. Once you press the Install or Buy button, the list of permissions the application requires is displayed. By continuing past this screen you have started the installation process and granted these permissions to the application.
Most useful applications require some permissions to function, but you should verify that the permissions being requested make sense for the application. For example, a fitness tracker that uploads your walking distance, speed, and path to a website for record keeping purposes would definitely need access to your GPS coordinates and the Internet. On the other hand, a widget that simply displays today’s date but is requesting the ability to send text messages or make phone calls should lead you to question why those permissions are needed. There may be a perfectly valid reason for a permission that seems odd or it may simply be a mistake made by the developer. But it could also be an indication that the program is going to do something illicit with your phone or data.
These are the most important things to evaluate when choosing any application from the Android Market in order to avoid malicious or even just poorly designed software. By following these precautions, in particular paying attention to the reputation the application has gained in the market and the permissions it is requesting, you can be reasonably confident that the application is safe. However, don’t be lulled into complacency after downloading the application. You may be prompted later to install an upgrade to the application. Each upgrade should be given the same evil eye: scan the recent comments and verify the permissions being requested to ensure they still make sense.
