19

How can we be assured that the APK of an app that we are downloading from a website is safe to install on our Android phone?

Is there a way to know that the downloaded file is safe? Is there an app or service that scans the APK file and says This file is safe to install.

1
  • 1
    If it's a for pay/ad supported app in official stores and the version you're sideloading is ad free and free of cost it's not safe. Sep 27, 2013 at 19:01

7 Answers 7

15

It is difficult to know whether an APK is safe or not. Your best bet is to download from trusted or reputable sources (like Google Play, Amazon, etc).

Some (trusted) developers also provide an MD5 (or other message-digest algorithm) hash of their APKs. After your download the APK, you verify if the APK has the same hash. If it does, then it's safe to say it hasn't been tampered with.

You can also check the permissions required by the APK / app, and use common sense (or your own judgement / instinct) to tell if it's safe to install or not.

BOTTOMLINE: Always install from trusted sources. Stay away from pirated APKs; it's possible they may have malware.

7
  • Is there any app that can detect if that application has a malware?
    – HTTP
    Sep 27, 2013 at 8:46
  • @Nesmar No idea, but you can always try an anti-virus in Google Play.
    – geffchang
    Sep 27, 2013 at 8:48
  • Honestly speaking, I dont have the confident on any anti virus in android because they are not running if you do not tap them, I mean ex in computer desktop, if you install antivirus, upon boot, they already running in background and monitoring your files. I dont know if you can do that in mobile phone also.
    – HTTP
    Sep 27, 2013 at 8:51
  • @Nesmar I think some anti-viruses can run as a service. Apps like Screebl and Ad Block Plus run when the phone boots.
    – geffchang
    Sep 27, 2013 at 9:04
  • 5
    +1 for the bottom line alone! When downloading from unknown sources, there's no easy way to judge. Even with the MD5: if both files (APK & MD5) are residing on the same server, who tells you they have not both been replaced?
    – Izzy
    Sep 27, 2013 at 9:36
9

Google introduced an option Verify apps (Disallow or warn before installation of apps that may cause harm) for side-loaded apps when unknown sources is enabled (both settings available in Settings -> Security -> device-administration).

You can also use an online virus scanner like Virus Total to check your downloaded .apk file.

But this is the same with every scanner service: They're not 100% sure and probably only detect already known malicious apps. Custom tailored malware will probably remain undetected. Also very new malicious apps will probably slip through until after some time they will be detected.

3
  • 1
    Malware scanners have been found to be easy to bypass (just do a little Google Search), so I wouldn't trust them further as I can see for myself. This includes Google's Verify apps.
    – Izzy
    Sep 27, 2013 at 9:46
  • Sure. However old malware is regularly found. No malware scanner provides 100% safety, you can even get malicious apps from the official play store (and Apple's Store is no exception to this). Those scanners do improve your safety, if you need to side-load, though. It's like apple's new finger print scanner: Already bypassed, but far better than no pin lock at all (~40% of owners don't have pin-locks for reasons of convenience).
    – ce4
    Sep 27, 2013 at 11:27
  • I agree. My fault to not make my point clear: Never rely on them in the way "Nothing can happen, I've got an anti-virus". If you see them but a piece of the puzzle (instead of the whole image), they can be helpful.
    – Izzy
    Sep 27, 2013 at 11:47
7

If you are downloading the .apk files from unknown/untrusted sources, there's no easy way to judge. Most Anti-Whatever solutions (anti-virus, anti-malware, etc.) are just ruling by "database entries" (i.e. they have a database of known malware, and check whether the package name matches), or only check requested permissions (and not whether e.g. a SMS app only sends the SMSs you wish). I've never heard about a "real" heuristics scanner analyzing an app's behaviour.

Though it might theoretically be possible a "scanner" also verifies a kind of checksum (as the mentioned MD5), this could only work against a "trusted base" like e.g. Playstore. For apps not available there it would fail then (nothing to compare). And even for apps available there, it would need to check against the very same version. Such a solution is hardly practical.

So while my arguments might differ, my bottom line is almost the same as geff's: Only install from trusted sources. While nothing is 100% secure, this imposes the smallest risks possible. The highest risk is with pirated stuff, as that's very likely to have "bad things" injected.

5
  • One way to judge, is to compare the certificate to known good publishers (i.e., if you want the latest version of Google's Ingress apk, go ahead and just compare if it's signed with the same certificate as the already installed one). You can upgrade already installed apps (from the Play Store) with side-loading if the certificate is the same. That'll be a safe option (if it is applicable).
    – ce4
    Sep 27, 2013 at 11:32
  • Does it automatically compare the certificate if you are upgrading an app via side-loading, or do you have to do something to verify the certificate is the same? If so, how would you verify that?
    – LeBleu
    Jan 24, 2014 at 15:55
  • 1
    @LeBleu if the app was already installed on your device, yes. Then the new .apk must be signed using the very same "key" the installed one used, or the update will fail.
    – Izzy
    Jan 24, 2014 at 16:06
  • is F-Droid a trusted source? I have known apps in Play Store that ended up being malware so not sure that is super safe either.
    – luchonacho
    Mar 2, 2021 at 15:58
  • 1
    @luchonacho how did Wired put it once? To Avoid Malware, Try the F-Droid App Store. Also see this PDF: a study made in 9/2017 analyzing the "bigger Android markets" with 2000 apps from each (at that time F-Droid had less than 2k apps and thus was covered entirely). The only place they didn't find any malware was F-Droid. So yes, I'd say it's a trusted source – for me the most trusted source.
    – Izzy
    Mar 3, 2021 at 10:25
5

You can upload the package to a mobile sandbox to see what it's doing. The sandboxes will execute the binary and you can see the execution resutls. This will also work for some formerly unknown malware as it doesn't have to be in some av-database before. Examples for sandboxes are MobileSandbox, CopperDroid, SandDroid, TraceDroid, Joe Sabdox Mobile, ForSafe and others.

As always, there is no 100% security, but then again, there is no complete security when downloading from Play store, either...

Virustotal that has been mentioned above recently started to run some samples in a sandbox as well and is of course always a good bet as it tests against a magnitude of already known malware. A similar service as Virustotal but specifically for Android is AndroTotal.

0

I use Lookout Security, it scans every app you install and you can also scan APKs

1
  • 1
    Scans them for what? Does it actually do heuristics analysis or some other reliable analysis or does it just run a database check for the APK name or MD5? Oct 1, 2013 at 8:13
0

App Permissions do offer certain level of security. One can always check for permissions during installation of apk.

When an app doesn't need root permission or any other permission, it can mostly be considered to be safe. There is only very little an app can do with no permissions. But it can trick user to display a malicious link and redirect the user to some malicious site to install something else or some phishing websites. If such app doesn't even use internet, then it can be considered safe.

With increasing level of permissions, the app can be more suspected unsafe. It can steal personal data like contacts, messages, call logs, or any file on your storage etc... Ofcourse that's only a possibility, not every app is malicious.

0

Nowadays, it's not that difficult to find safe APK files. But you have to be careful while choosing the source sites.

Secondly, after downloading any APK from anywhere, scan it through VirusTotal (to make sure that the downloaded app is safe and secure).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .