After reading this article ( Kaspersky smartphone report ) this got me wondering.
Obviously if I install a dodgy app through Play Store or directly from a website, that can be dangerous, however if I install a popular app from the Play Store that has 10 million downloads for example, most likely it will be virus free.
So most of the Android hacks I've read about are people giving install permission to dodgy apps, however can my android phone be hacked without me installing an app at all?
There is always the possibility of a vulnerability in some app that could cause your computer/phone to be hacked. Browsers are notorious for having bugs that allow the computer to be infected with a virus simply by viewing a page. In fact, one method to jailbreak an early Apple iOS device was to simply browse to a page that delivered a payload via a bug in pdf (source).
Android mitigates this by having apps run in their own sandbox. Thus, an app that is compromised can only (theoretically) compromise its sandbox, which includes any permissions it originally was granted. If compromised, it couldn't send an SMS unless it had that permission originally, nor could it modify other programs' data. But even sandboxing is not foolproof.
If your phone is plugged in to a computer, it can be 'hacked'. This is proven by most rooting methods that use a bug to get root. Programmers could just as easily create a virus for computers that detects Android phones and installs a malicious app silently, or even roots them and takes over the phone completely.
This talk has some great details on app permissions. It isn't necessarily hacking, but it does show how an app with very few, seemingly innocuous, permissions can actually track and do a lot without you knowing.
In the end, your android device is a computer, with all the same inherent flaws that come with it. So like a desktop, if you are careful about where you browse and what you install, you'll likely be fine.
The browser is a big security risk especially for older Android versions. For example:
http://threatpost.com/en_us/blogs/researcher-publishes-android-browser-exploit-110810
http://news.techworld.com/security/3250255/android-browser-vulnerability-exposes-user-data/
http://www.livehacking.com/category/vulnerability/android-vulnerability/
For older devices (on 2.2 or older) it may be best to use Firefox or Opera mobile browsers, which you can update regularly, unlike the built-in browser.
