Google: Android nearly impenetrable to malware

[Bateluer]

Saw this linked over at /r/Android. Interesting read and puts to bed another myth that Android is riddled with malware and viruses.

http://qz.com/131436/contrary-to-what-youve-heard-android-is-almost-impenetrable-to-malware/

Until now, Google hasn’t talked about malware on Android because it did not have the data or analytic platform to back its security claims. But that changed dramatically today when Google’s Android Security chief Adrian Ludwig reported data showing that less than an estimated 0.001% of app installations on Android are able to evade the system’s multi-layered defenses and cause harm to users. Android, built on an open innovation model, has quietly resisted the locked down, total control model spawned by decades of Windows malware. Ludwig spoke today at the Virus Bulletin conference in Berlin because he has the data to dispute the claims of pervasive Android malware threats.

Ludwig sees security in biological terms:

“A walled garden systems approach blocking predators and disease breaks down when rapid growth and evolution creates too much complexity. Android’s innovation from inside and outside Google are continuous, making it impossible to create such a walled garden by locking down Android at the device level.”

 

[Eug]

Hmmm...

0.001% of apps means that if there are 10 million app installations, 100 will be infected by malware.

For 1 billion app installations, that means 10000 will be infected by malware.

 

[Red Storm]

Hmmm...

0.001% of apps means that if there are 10 million app installations, 10000 will be infected by malware.

For 1 billion app installations, that means 1 million will be infected by malware.

... he did say less than.

As always the best firewall is the user themselves. I GREATLY prefer the Android way of things in this regard.

 

[dguy6789]

Hmmm...

0.001% of apps means that if there are 10 million app installations, 10000 will be infected by malware.

For 1 billion app installations, that means 1 million will be infected by malware.

That's probably a similar rate to what malware is on the iOS app store

 

[Eug]

That's probably a similar rate to what malware is on the iOS app store

It's not:

Android devices attract 79% of malware attacks; iOS gets just 0.7%

US authorities have warned security personnel that mobile devices powered by the Android operating system are especially vulnerable to malware and other hacks.

The internal memo reported that Android attracted 79 per cent of all malware attacks, followed by Nokia’s Symbian software with 19 per cent. Apple’s iOS software attracted just 0.7 per cent of attacks.

The memo, published by the Department of Homeland Security and the Federal Bureau of Investigation, said that this was because of the OS’s “market share and open source architecture”.

The large market share (just under 80 per cent of the global smartphone trade) appeals to hackers’ sense of efficiency: they will have to spend less time coding to attack more systems.

Another major problem for Android is the fragmentation associated with the OS: not all Android users run the most recent version of the software and without updates the software is more vulnerable to hacks.

 

[Lil Frier]

Hmmm...

0.001% of apps means that if there are 10 million app installations, 10000 will be infected by malware.

For 1 billion app installations, that means 1 million will be infected by malware.

1% = .01
.001% = .00001
1,000,000,000 * .00001 = 10,000

That means that for every 1 BILLION installations, there are 10,000 infections. I think most people with a brain know that Android's not a virus-riddled mess, but people like to bring up the virus issue with Android in the same was Mac users bring it up with Windows users. It's usually just a joking mention and a small notch in the belt of the competition.

 

[Eug]

1% = .01
.001% = .00001
1,000,000,000 * .00001 = 10,000

That means that for every 1 BILLION installations, there are 10,000 infections.

Yes, my math is off by a factor of 100. Thanks for correcting that. I have corrected my original post.

I think most people with a brain know that Android's not a virus-riddled mess, but people like to bring up the virus issue with Android in the same was Mac users bring it up with Windows users. It's usually just a joking mention and a small notch in the belt of the competition.

Well, maybe not a virus-riddled mess, but still a more significant target than the competition. US Homeland Security was concerned enough to warn its users about Android:

http://forums.anandtech.com/showthread.php?p=35568088#post35568088

 

[Bateluer]

1% = .01
.001% = .00001
1,000,000,000 * .00001 = 10,000

That means that for every 1 BILLION installations, there are 10,000 infections.

Yep, pretty much. Essentially, inconsequential. And thats a random sampling of a billion app installs. If the user exercises a modicum of sense when looking at a Play Store app, they won't even had a chance of getting infected. I'd wager that the likelihood rises with non-Play Store app, which every power user enables the installation of.

Another major problem for Android is the fragmentation associated with the OS: not all Android users run the most recent version of the software and without updates the software is more vulnerable to hacks.[/i]

No matter how many times this myth is buried, people keep digging it up. At this point, its gone beyond a decomposing corpse and into severely fractured bones held together with scotch tape. Please, leave this in the ossuary.

 

[lopri]

... he did say less than.

As always the best firewall is the user themselves. I GREATLY prefer the Android way of things in this regard.

Totally agree. My Android is also totally impenetrable to malware and spam/ads thanks to firewalls and adblocks. I used to get weird marketing spams when I had some other phone. (Does anyone else in NY metro area know this person called "Jhonny Appleseed?")

It is, however, inevitable that Android's relative open-ess as well as large userbase will attract more malware in the future. Even then, if one only downloads apps from Play store the chances of getting malware will be exceedingly low. But if you get apps from other Android markets, you probably need to know what you are doing.

 

[openwheel]

It's amazing Android has this level of security with it's open source nature.

 

[Suspicious-Teach8788]

Saw this linked over at /r/Android. Interesting read and puts to bed another myth that Android is riddled with malware and viruses.

http://qz.com/131436/contrary-to-what-youve-heard-android-is-almost-impenetrable-to-malware/

Let's stop concluding that certain beliefs are myths based on one article. You seem to think a lot of things are myths and have your head in the sand.

It may be impenetrable, but it seems most malware attacks still affect Android rather than iOS.

Here's an example of a prevalent Whatsapp worm that I saw spread. Given Whatsapp's 300 million users, this was all over the place.

http://nakedsecurity.sophos.com/2013/07/11/whatsapp-users-ignore-messages-from-priyanka-its-a-worm/

 

[Bateluer]

It's amazing Android has this level of security with it's open source nature.

Open source software usually has better security since its, well, open. Anyone can look at the code, white or black hat. It translates to vulnerabilities being discovered, publicized, and patched or worked around much quicker. In closed/proprietary ecosystems, exploits and vulnerabilities are buried, often taking months or years to patch out.

Android had the advantage of being developed in the Internet age where everything is connected all the time, and had security baked into it at the lowest levels.

 

[zerocool84]

Plus most of the malware people get is not from the Play Store but from other sources like third party marketplaces or links to sideload apps.

 

[dguy6789]

Let's stop concluding that certain beliefs are myths based on one article. You seem to think a lot of things are myths and have your head in the sand.

It may be impenetrable, but it seems most malware attacks still affect Android rather than iOS.

Here's an example of a prevalent Whatsapp worm that I saw spread. Given Whatsapp's 300 million users, this was all over the place.

http://nakedsecurity.sophos.com/2013/07/11/whatsapp-users-ignore-messages-from-priyanka-its-a-worm/

It's sorta misleading to use the word most when it is such a tiny number that it does not matter.

Android has a significantly larger user base. Android is attacked more often than iOS because of that. The same reason Windows is attacked more than OS X despite OS X being far less secure.

 

[ChronoReverse]

The other thing is the Whatsapp malware is flaw in Whatsapp itself and relies on manual transmission:

it spreads manually, relying on victims to accept and install a contact file from a friend, named "Priyanka," before it starts its funny business.

 

[Suspicious-Teach8788]

It's sorta misleading to use the word most when it is such a tiny number that it does not matter.

Android has a significantly larger user base. Android is attacked more often than iOS because of that. The same reason Windows is attacked more than OS X despite OS X being far less secure.

79% versus 0.7% is not the ratio of Android to iOS users. If it was something like 2:1, I could understand, but this is far different. Orders of magnitudes different.

Furthermore, the OP's article is misleading. Malware infections on Android are not like the malware we deal with on Windows. On Windows, it's almost too easy to get infected and have that infection hide deep in the system. One simple trojan that gets through and you could be asking for a reformat if it weren't for those nifty spyware/recovery tools out there.

On Android on the other hand, a lot of infections are sandboxed, and so they can be easily removed by uninstalling an app. Quite simple. So yes the article is right in that Android doesn't get easily penetrated, but that's like saying Country XYZ is riddled with diseases and you come out with a counterargument say "Well very few people die from these diseases." Whether its fatal diseases or the common cold, if there's widespread infections, its an epidemic. So it may be accurate that Android doesn't get penetrated because the infection is sandboxed, it doesn't mean that there are very few Android malware infections.

 

[openwheel]

It's sorta misleading to use the word most when it is such a tiny number that it does not matter.

Android has a significantly larger user base. Android is attacked more often than iOS because of that. The same reason Windows is attacked more than OS X despite OS X being far less secure.

exactly

 

[st_7]

The same reason Windows is attacked more than OS X despite OS X being far less secure.

Take a break sir, don't waste your time, because Apple users(loyal users) doesn't listen at all, the same argument was made and the same reason was given in many threads of many forums but they talk the same.

The basic point is this, whoever write Virus programs don't target minority but target majority, because they gain nothing in writing their virus programs targetting minority. People with little bit knowledge of computer things(say an average knowledged person) & used both platforms will understand that Windows is more secure than OS X. I used both of them, I'm little more educated(read an average knowledged) in computers than a common man. I'm not an expert & I don't have an advanced knowledge in Software, but in my experience I realised how secure Windows is than OS X. Apple themselves know this, they release huge updates of hundreds of MBs for OS X almost every month. The loopholes in the OS X are very basic & so silly that you wonder how did they miss that point. And with little care, I'm using my Windows system almost for the past 3-4 years without an Anti-Virus, although I do install AV in my system that is only for testing & within couple of days of installation it will be uninstalled. And I've not faced any virus effects in my system all these years.

This samething(reasoning) may apply with IOS & Android argument, because there are many more Android users than IOS, more virus programms are bound to be written targetting Android than IOS.

 

[BladeVenom]

By comparison, there has been 68.3 million individual pieces of malware from 1984 to 2012, mostly for Windows I reckon. http://www.cso.com.au/article/419622/how_much_malware_has_arrived_since_1984_/

 

[OS]

http://arstechnica.com/gadgets/2013...oems-step-aside-google-is-defragging-android/

If you count the Google Play Process, nearly 100% of the platform is infected, LOL