0

I am using XPrivacy + Xposed Framework. is it safe to consider that malware can be controlled thank to Xprivacy?

  • I doubt it's safe to say that about any app, as there's no 100% protection success rate. Especially not if the user thinks it's safe, and switches off "common sense" because of that. That's one of the biggest weak points of such software: to rely on it too much. – Izzy Sep 23 '14 at 15:20
  • I see. Though the sensitive and potentially fatal functions are still blocked aren't they? But there are surely a way to avoid xprivacy – Vinz243 Sep 23 '14 at 19:25
  • Don't get me wrong, Vinz. Xprivacy is definitly a great help in that. But you never can rely on any tool (or collection of tools) to guarantee you 100% safety (especially not those "Anti-Virus" stuff). As the name suggests, Xprivacy primarily cares for privacy, not for malware protection. – Izzy Sep 23 '14 at 22:42
1

Long version

Ok so let me first highlight what XPrivacy can and can't do.

Up to Android 6, permissions to access critical data and resources like contacts, calendar, camera, microphone etc are granted at the time an app is installed and are not revocable at all. Some solutions let you revoke those permission afterwards, but this often leads to crashes because apps do expect to have access to those resources. Therefore, at some point solutions like XPrivacy decided to not revoke permissions but to provide fake data. For example, if you "soft revoke" the contacts permission, an app will not get an error when trying to access them but will receive an empty contacts list. So what can XPrivacy do? It can guard your privacy by altering what apps can read.

Now, let's talk about malware on Android. In contrast to desktop systems, classical malware like viruses or rootkits are not possible in Android as long as there is no severe flaw in the Android itself. The reason is, that each app is sandboxed and only given restricted access to resources (eg via permissions). By the way, this is also the reason why antivirus on stock Android does not work the way we are used to from desktop systems. As the antivirus is also sandboxed, it cannot monitor, change or restrict other apps that might be malware. So what malware are we talking about now? Most common are combinations of trojan horses and spyware. To be more precise, apps that pretend to provide benign functionality but also spying on you. Also, a lot of actually non-malicious but overly-curious apps exist that provide real functionality but also collect your data.

Now we can actually get to the answer of your question. If you use XPrivacy to revoke permissions of the spyware, there is not too much it can do. But the problem is, that spyware is often disguised as a benign or well-known application which might not work properly with fake data. So there are two possibilities now when treating a malicious app. Either you detect it to be malicious and remove it, or you do not detect it (because it might also have real functionality) and then you won't restrict its permissions so that it does not work anymore because you think it is a regular app. This social engineering component is a big problem.

Summary/Short version

XPrivacy does not find apps that actively use known vulnerabilities and does neither modify nor closely inspect potential malware. It just allows you to restrict app permissions. So in contrast to classical antivirus approaches known from desktop operating systems like windows, you have to decide what to restrict and where. In general, it is a good idea to restrict apps to the least set of permissions that needed to function properly (principle of least privilege). If you do this consequently for ALL apps, chances are high you also restrict malware. But as long as there are apps that for example need the internet permission for their benign activities but also to upload data that the spyware collected, this approach is simply not enough.

So no, you should not rely on XPrivacy to defeat all malware. It is just a tool for you, so its utility depends on your choices.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.