19

How can we be assured that the APK of an app that we are downloading from a website is safe to install on our Android phone?

Is there a way to know that the downloaded file is safe? Is there an app or service that scans the APK file and says This file is safe to install.

  • 1
    If it's a for pay/ad supported app in official stores and the version you're sideloading is ad free and free of cost it's not safe. – Dan Neely Sep 27 '13 at 19:01
15

It is difficult to know whether an APK is safe or not. Your best bet is to download from trusted or reputable sources (like Google Play, Amazon, etc).

Some (trusted) developers also provide an MD5 (or other message-digest algorithm) hash of their APKs. After your download the APK, you verify if the APK has the same hash. If it does, then it's safe to say it hasn't been tampered with.

You can also check the permissions required by the APK / app, and use common sense (or your own judgement / instinct) to tell if it's safe to install or not.

BOTTOMLINE: Always install from trusted sources. Stay away from pirated APKs; it's possible they may have malware.

  • Is there any app that can detect if that application has a malware? – HTTP Sep 27 '13 at 8:46
  • @Nesmar No idea, but you can always try an anti-virus in Google Play. – geffchang Sep 27 '13 at 8:48
  • Honestly speaking, I dont have the confident on any anti virus in android because they are not running if you do not tap them, I mean ex in computer desktop, if you install antivirus, upon boot, they already running in background and monitoring your files. I dont know if you can do that in mobile phone also. – HTTP Sep 27 '13 at 8:51
  • @Nesmar I think some anti-viruses can run as a service. Apps like Screebl and Ad Block Plus run when the phone boots. – geffchang Sep 27 '13 at 9:04
  • 5
    +1 for the bottom line alone! When downloading from unknown sources, there's no easy way to judge. Even with the MD5: if both files (APK & MD5) are residing on the same server, who tells you they have not both been replaced? – Izzy Sep 27 '13 at 9:36
9

Google introduced an option Verify apps (Disallow or warn before installation of apps that may cause harm) for side-loaded apps when unknown sources is enabled (both settings available in Settings -> Security -> device-administration).

You can also use an online virus scanner like Virus Total to check your downloaded .apk file.

But this is the same with every scanner service: They're not 100% sure and probably only detect already known malicious apps. Custom tailored malware will probably remain undetected. Also very new malicious apps will probably slip through until after some time they will be detected.

  • 1
    Malware scanners have been found to be easy to bypass (just do a little Google Search), so I wouldn't trust them further as I can see for myself. This includes Google's Verify apps. – Izzy Sep 27 '13 at 9:46
  • Sure. However old malware is regularly found. No malware scanner provides 100% safety, you can even get malicious apps from the official play store (and Apple's Store is no exception to this). Those scanners do improve your safety, if you need to side-load, though. It's like apple's new finger print scanner: Already bypassed, but far better than no pin lock at all (~40% of owners don't have pin-locks for reasons of convenience). – ce4 Sep 27 '13 at 11:27
  • I agree. My fault to not make my point clear: Never rely on them in the way "Nothing can happen, I've got an anti-virus". If you see them but a piece of the puzzle (instead of the whole image), they can be helpful. – Izzy Sep 27 '13 at 11:47
7

If you are downloading the .apk files from unknown/untrusted sources, there's no easy way to judge. Most Anti-Whatever solutions (anti-virus, anti-malware, etc.) are just ruling by "database entries" (i.e. they have a database of known malware, and check whether the package name matches), or only check requested permissions (and not whether e.g. a SMS app only sends the SMSs you wish). I've never heard about a "real" heuristics scanner analyzing an app's behaviour.

Though it might theoretically be possible a "scanner" also verifies a kind of checksum (as the mentioned MD5), this could only work against a "trusted base" like e.g. Playstore. For apps not available there it would fail then (nothing to compare). And even for apps available there, it would need to check against the very same version. Such a solution is hardly practical.

So while my arguments might differ, my bottom line is almost the same as geff's: Only install from trusted sources. While nothing is 100% secure, this imposes the smallest risks possible. The highest risk is with pirated stuff, as that's very likely to have "bad things" injected.

  • One way to judge, is to compare the certificate to known good publishers (i.e., if you want the latest version of Google's Ingress apk, go ahead and just compare if it's signed with the same certificate as the already installed one). You can upgrade already installed apps (from the Play Store) with side-loading if the certificate is the same. That'll be a safe option (if it is applicable). – ce4 Sep 27 '13 at 11:32
  • Does it automatically compare the certificate if you are upgrading an app via side-loading, or do you have to do something to verify the certificate is the same? If so, how would you verify that? – LeBleu Jan 24 '14 at 15:55
  • 1
    @LeBleu if the app was already installed on your device, yes. Then the new .apk must be signed using the very same "key" the installed one used, or the update will fail. – Izzy Jan 24 '14 at 16:06
5

You can upload the package to a mobile sandbox to see what it's doing. The sandboxes will execute the binary and you can see the execution resutls. This will also work for some formerly unknown malware as it doesn't have to be in some av-database before. Examples for sandboxes are MobileSandbox, CopperDroid, SandDroid, TraceDroid, Joe Sabdox Mobile, ForSafe and others.

As always, there is no 100% security, but then again, there is no complete security when downloading from Play store, either...

Virustotal that has been mentioned above recently started to run some samples in a sandbox as well and is of course always a good bet as it tests against a magnitude of already known malware. A similar service as Virustotal but specifically for Android is AndroTotal.

0

I use Lookout Security, it scans every app you install and you can also scan APKs

  • 1
    Scans them for what? Does it actually do heuristics analysis or some other reliable analysis or does it just run a database check for the APK name or MD5? – onik Oct 1 '13 at 8:13
0

Now a days it's not that difficult to find safe Apk files. But you have to be careful while choosing the source sites. I personally recommend ApkLink.com . Secondly after downloading any apk from anywhere I'll suggest you to scan through VirusTotal (to make sure that downloaded app is safe and secure).

0

App Permissions do offer certain level of security. One can always check for permissions during installation of apk.

When an app doesn't need root permission or any other permission, it can mostly be considered to be safe. There is only very little an app can do with no permissions. But it can trick user to display a malicious link and redirect the user to some malicious site to install something else or some phishing websites. If such app doesn't even use internet, then it can be considered safe.

With increasing level of permissions, the app can be more suspected unsafe. It can steal personal data like contacts, messages, call logs, or any file on your storage etc... Ofcourse that's only a possibility, not every app is malicious.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.