Can I use XPrivacy as an Antivirus?

Question

I am using XPrivacy + Xposed Framework. is it safe to consider that malware can be controlled thank to Xprivacy?

Answer 1

Long version

Ok so let me first highlight what XPrivacy can and can't do.

Up to Android 6, permissions to access critical data and resources like contacts, calendar, camera, microphone etc are granted at the time an app is installed and are not revocable at all. Some solutions let you revoke those permission afterwards, but this often leads to crashes because apps do expect to have access to those resources. Therefore, at some point solutions like XPrivacy decided to not revoke permissions but to provide fake data. For example, if you "soft revoke" the contacts permission, an app will not get an error when trying to access them but will receive an empty contacts list. So what can XPrivacy do? It can guard your privacy by altering what apps can read.

Now, let's talk about malware on Android. In contrast to desktop systems, classical malware like viruses or rootkits are not possible in Android as long as there is no severe flaw in the Android itself. The reason is, that each app is sandboxed and only given restricted access to resources (eg via permissions). By the way, this is also the reason why antivirus on stock Android does not work the way we are used to from desktop systems. As the antivirus is also sandboxed, it cannot monitor, change or restrict other apps that might be malware. So what malware are we talking about now? Most common are combinations of trojan horses and spyware. To be more precise, apps that pretend to provide benign functionality but also spying on you. Also, a lot of actually non-malicious but overly-curious apps exist that provide real functionality but also collect your data.

Now we can actually get to the answer of your question. If you use XPrivacy to revoke permissions of the spyware, there is not too much it can do. But the problem is, that spyware is often disguised as a benign or well-known application which might not work properly with fake data. So there are two possibilities now when treating a malicious app. Either you detect it to be malicious and remove it, or you do not detect it (because it might also have real functionality) and then you won't restrict its permissions so that it does not work anymore because you think it is a regular app. This social engineering component is a big problem.

Summary/Short version

XPrivacy does not find apps that actively use known vulnerabilities and does neither modify nor closely inspect potential malware. It just allows you to restrict app permissions. So in contrast to classical antivirus approaches known from desktop operating systems like windows, you have to decide what to restrict and where. In general, it is a good idea to restrict apps to the least set of permissions that needed to function properly (principle of least privilege). If you do this consequently for ALL apps, chances are high you also restrict malware. But as long as there are apps that for example need the internet permission for their benign activities but also to upload data that the spyware collected, this approach is simply not enough.

So no, you should not rely on XPrivacy to defeat all malware. It is just a tool for you, so its utility depends on your choices.