Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It only takes a minute to sign up.
Sign up to join this community
Are the apps on the Android Market checked or audited?
If I search Google for "hardening Android", the best hit I can find is Google Android Hardening Checklist.
What's your opinion regarding this? Is there a way to make Android safer or more secure?
Google added a new security layer to the Android market in February 2012.
Adding a new layer to Android security
Today we’re revealing a service we’ve developed, codenamed Bouncer, which provides automated scanning of Android Market for potentially malicious software without disrupting the user experience of Android Market or requiring developers to go through an application approval process.
For further information read here: http://googlemobile.blogspot.com/2012/02/android-and-security.html
Android 4.2 has added extra security with a setting that allows Google's security scanner to (optionally) scan all of your non-Market (ie side-loaded) apps for malware too.
The feature is an extension of the security technology Google introduced for the Play Store this past February. While that technology worked exclusively on the server side, analyzing apps that were uploaded to the Play Store, the new system works with your device and scans any apps you install from third-party sources (a process known as "sideloading").
(ComputerWorld: Inside Android 4.2's powerful new security system)
It only takes a one time fee of $25 for a developer to start putting apps on the market. No hoops to jump through. $25 and you can publish as many applications as you want, instantly. No waiting, no queues, no approval process, nada.
However, there have been a few cases of malicious applications. When these problems arise, Google usually pulls them from the Market (and from user's phones). It doesn't happen very often.
Android was designed to to keep yourself protected: all applications have to ask for "permissions" to do certain things: make calls, read contact data, access the internet, etc. Read the permissions before you install an application. Make sure you know and understand what it is going to be doing. Does it seem to have a dubious "permission" that it asks for access to? However, at the same time: don't berate the developer because of certain permissions. Some ads ran in apps require at least the internet permission and sometimes some other ones (about the phone state, I believe). Be sure to have a thorough understanding of why a developer would need certain permissions. Most importantly, read what other people are saying about the application in the market. Read some of the comments (although beware that the comments on the Android market are the same level as Youtube in terms of quality) and see what the app's rating is. Have you heard of the app before? Has a blog mentioned or reviewed it?
Worse case scenario: if you aren't rooted, then no single application should be able to damage your phone as every application is sandboxed from each other (technically, each developer's set of applications are sandboxed from each other. Apps signed by the same developer key can have access to other apps signed by the same developer). They could potentially steal your data, depending on the amount of permissions the application is given. The rarest scenario I can think of is if an application uses an exploit to enable root access on your phone and then does something malicious (e.g., delete everything).
I do not believe anyone from Google explicitly audits Market apps. They probably run some checks now to look for known malware (edit: yes, see Leandros' answer) and that sort of thing, but Android apps do not have an approval process like iOS apps. See http://en.wikipedia.org/wiki/Android_Market#Application_security
The best way to keep your device secure is to make sure others never have access to it, and to make sure you only download apps you trust. Android uses a Linux-style kernel and has a tightly sandboxed security model, so as an OS it's very safe in and of itself. You mostly need to protect against user error :)
No platform is 100% user-proof, so exercise caution and common sense in the same way as you do on your desktop -- you probably wouldn't install some random program on your computer that you heard about on a website without some prior research, even with an antivirus program/latest updates installed.
Same rules here -- do yourself a favour and find more information about the program you are interested in and its developers. Market comments are usually a good place to start, but perusing other Android-related sites won't hurt either,
Assuming you're in the US, the new, just launched Amazon Android Appstore does check and audit the apps before they're put up on the store, so should be a safer place to get your apps from.
From their Developer FAQ:
Our goal is for Amazon Appstore customers to have a good experience with every app they buy from the Appstore. As a result, we will be testing the apps you submit prior to making them available in our store to verify that each app works as outlined in your product description, does not impair the functionality of the mobile device or put customer data at risk once installed, and complies with the terms of the Distribution Agreement and our Content Guidelines.
However, as they've only just launched this week, they don't have any long term record that we can look at to see how effective their screening is, and what they do if an app does slip through their process somehow.
If you are worried about people getting a hold of your device and using it, you can add a passphrase, code, or swipe gesture to keep people out. If you are worried about the data within individual apps once the phone is unlocked, Protector does a nice job of blocking access to a list of apps you specify, enter a PIN to unlock.
There are antivirus products like AVG and Lookout, but I don't think they detect spyware. Google Market itself is really risky, since anyone in your account can remotely add any app, and some security holes have been found and patched. Best thing to do is check an app's permissions when installing, and use antivirus and firewall such as droidwall for privacy.
