28

Do I need to worry about malicious apps on Google Play, or can I trust everything I install, so long as I install it from Google Play?

And if I need to worry, what red flags should I look for - number of downloads, ratings, how old the app is, what permissions it requires?

On a practical level, would you say that it is as safe as Apple's App Store?

Improve this question
6
  • 6
    Long story short: No software distribution service is 100% safe. Each app should be evaluated individually. – dotVezz Oct 24 '13 at 13:39
  • 4
    See also: Does Google Audit all apps that enter the market place? and Are the apps safe? How can I make my Android more secure? – ale Oct 24 '13 at 14:08
  • @dotVezz Thanks. So Android is as safe as Apple's App Store? I've had an iPad, recently bought an Xperia S, and I was wondering. – sashoalm Oct 24 '13 at 14:08
  • Like Izzy said, "We don't compare apples to peaches" (or something). It's likely that the Play Store has more malicious apps than the App Store at any time. But that doesn't make either more dangerous than the other. Merely the presence of a malicious app doesn't undermine the security of a distribution system. In the end, you are responsible to research anything you install on your device. – dotVezz Oct 24 '13 at 15:26
  • 3
    @dotVezz is technically correct, but this is a good question because it is useful to have some sense of your risk exposure. For example, you are safer installing an app from the Play Store than some random .apk you found on the interwebs. This question might help people understand how much safer. – Reid Oct 24 '13 at 19:01
34

We don't compare apples with peaches. But it's always a good idea to be careful what you install. True, Google Play is to be considered one of the safest sources for Android apps. Still, some malware sneaks in every now and then. So you should use some common sense before hitting the "Install" button.

Things to look at include (but might not be restricted to):

  • What permissions are required?
    Though not always easy to decide, there are some things which can count as indicators – e.g. taking a simple calculator app, it certainly doesn't need access to your contacts, calendars, system settings, etc.
  • How is it rated?
    I'm not talking about "naked numbers", but check the comments. They might give you useful hints on whether it's safe to install. Also, an app installed several thousands of times with no traces of maliciousness in the comments should be considerably safer than an app with almost no installs and no comments.
  • Should it be a very popular app, but only has few installs?
    That's in most cases a clear indicator for malware, hiding behind a popular name. Better keep your hands off those.

Aside of that: In case you're still unsure, pick a good forum and ask. Another good idea is to check other apps from the same developer (just follow the link on his name), and use above criteria on them.

Improve this answer
6
  • 2
    We have a few good "Is this app malware?" questions on ASE already. I think we can reasonably encourage more questions like that, instead of pointing users to other sites. – Dan Hulme Oct 24 '13 at 13:42
  • Thanks for the hint, @DanHulme – I wasn't sure whether to encourage that. Will update my answer accordingly (neutralizing ;) Better? (if so, we could remove our comments ;) – Izzy♦ Oct 24 '13 at 13:44
  • 3
    Your third point is so excellent that I could not possibly recommend this answer enough. The Play Store is rife with unofficial clones of varying levels of iffyness and every effort should be taken to avoid them. – dotVezz Oct 24 '13 at 13:45
  • Another important tip: If the app has a lot of 5 star reviews, read them and see if they are legit reviews. It is too easy to farm reviews these days, and a lot of fake apps do this to get a high ranking on the play store. – Munim Oct 30 '13 at 5:17
  • 1
    @Munim same applies to low-rated comments. Aside from faked ones ("bought by competition") there are also stupid ones (where users didn't understand what the app was for, or had problems with downloading from Google Play which have nothing to do with the app). This both together was what I refered to with my second point: check the comments (note: check, not count ;) – Izzy♦ Oct 30 '13 at 14:33
12

It is possible for there to be malicious apps on Google Play. However, there are a number of things that you can do to protect yourself:

  1. Check the permissions that an app requests when installing. If it looks excessive for what the app does, then you can email the developer and ask why they need the permissions they ask for. Most developers should be happy to do this, although it may take a while to get a response.
  2. Look at the amount of downloads and reviews. If it doesn't have many downloads then be more cautious. It does not however, mean that the app is malicious, just that you need to check more yourself. If it has a lot of 1-2 star reviews then i'd probably stay clear as well.
  3. If it is a popular app (such as Need For Speed, Riptide GP etc.) that is normally a paid for app, but you find a free version then be very careful. A common tactic by malware authors is to pose as popular apps but actually they install malware on your device.

Essentially you have to use common sense. If in doubt don't install the app. Google does have a system called Bouncer which scans all apps uploaded to the Play Store which has reduced the amount of malicous apps but it is not 100% guaranteed.

Improve this answer
3
  • 1
    I love the third point, but I think the examples used are a bit misleading. It's important to note that Angry Birds actually is officially free on the Play Store. Not to mention PvZ2 has embraced the free-to-play model. – dotVezz Oct 24 '13 at 13:47
  • 1
    Good point. I've replaced the examples with apps that aren't normally free. – bmdixon Oct 24 '13 at 13:59
  • @bmdixon Also, you can check the vendor name, to see if it is the same as the vendor name of the official app. – sashoalm Oct 24 '13 at 14:01
6

Anyone who has any experience programming and working on both Android and iOS apps can tell you that there are most certainly malicious apps on the Play store. Here's the deal:

In order to publish your app to Apple's App store you have to submit it to Apple for review. Oh, and you also have to pay them $99 per year and jump through some other hoops. Either way, Apple goes through your app's code line by line (or at least that's what they claim) and verify there is not malicious code. As a lot of devs can tell you, it's not hard to get an app rejected and not all that uncommon to have to resubmit. The end result is that the Apple App Store is about as safe as it gets. Not perfect, but as far as safety it doesn't get much safer.

Now, if I develop and app for Android I can basically just upload it to the Play Store. I will need to create a developer account, but that's all I have to do. If my app contains known viruses or malware Google will eventually catch it and remove it from the app store.

The important thing to keep in mind about Android is that it really is closer to Windows in that you can easily mess around and download an app or apps that can steal your personal information, slow your system down due to poor design or ads, and any number of other things. My best advice is to pay very close attention to an apps permissions and if in doubt just don't install it. Also, even if you don't usually read reviews on iOS devices, I would recommend that you at least take a look at the reviews for any lesser known Android app you are considering installing. You can find out pretty quickly if the app has been causing other users problems with their devices.

For this reason, I would not recommend just indiscriminately downloading every single app that looks interesting on Android. You really should be savvy enough to pay attention and protect yourself. In addition to programming I have also worked for a few years in the mobile industry and I can tell that I hated to see older users get Androids because they would end up with so much crap on their phone and then wonder why it didn't work the way they wanted. If this is you, then you maybe you should go with Apple. If you don't mind paying attention to what you are doing then Android will treat you very well! Hope this helps.

Improve this answer
3
  • 3
    What about the permissions, though? I wanted to install a Sudoku app, and the top app on Google Play requires access to my "Network connection", "Phone calls" and "System tools", among others. This app has a 100,000 downloads, so it has to be legit, but if legit apps want these permissions, how do I distinguish viruses? – sashoalm Oct 25 '13 at 6:16
  • 3
    Apple doesn't check the source code, though, see stackoverflow.com/a/3188649/492336 for more details on how their review process works. – sashoalm Oct 25 '13 at 6:31
  • 4
    That's right. Roan's answer contains quite a lot mistakes: Apple cannot check the source code (how should they, you only upload the binary app), also you have to pay a fee to get an Android Developer Account as well. The Play store has automatic malware checks which might be as much of a security check as Apple's process (human testings will have to focus on looks&feel there as you can easily make an app that behaves normally during review...). – florian h Oct 25 '13 at 7:39
5

It is entirely possible for a malicious app to become available through it. However, the same can be said for any other software distribution system. The App Store is not immune to sneaky devs either.

Never assume that any software distributor offers 100% safe software. Whether you're using Windows, OSX, iOS, Android, Linux, Unix, FreeBSD, or any OS, the only person who should be responsible for your security is you, yourself.

When installing software, make sure that you trust the vendor and the app itself, regardless of how much you trust the supplier. If you trust Rovio, then Angry Birds is going to be just as safe on iOS as it is on Android, or any other platform it's available on.

Improve this answer
1
  • 1
    This advice is hard to operationalize. How are you going to evaluate a given .apk in vacuo? The distribution channel is part of the risk evaluation. Ignoring it because it doesn't give 100% confidence is needlessly pedantic and not very useful. – Reid Oct 24 '13 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.