Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an unprivileged user. That being said, real anti-virus companies like AVG and McAfee have released anti-virus apps for Android.

How do these anti-virus apps work? Are they effective?

share|improve this question
add comment

1 Answer 1

up vote 7 down vote accepted

The basic tasks of an antivirus do not require that much of super-user accesses; to see whether a given executable file seems to contain a known virus, then read access to that file is sufficient. This can be done from userland, without modifying the kernel or even obtain root privileges; the system of configurable permissions for apps can handle that. Similarly, interception of network traffic can be done with the relevant permission.

What would require fiddling with the kernel would be launching the antivirus on a file when that file is executed. But Android has a stricter security model than desktop operating systems; application code cannot do everything it wishes, e.g. inspecting the RAM used by other applications. This constraints what an antivirus can do, but also what virus can do. If malware has already gone beyond this system-enforced layer, then things are much worse than what antivirus can fix.

On a rooted device, of course, these things change a lot. A rooted device is much similar to, say, a PC. In that case a PC running a kind of Linux, where both virus and antivirus are scarce.

Apparently, Google is (or was) very much against the mere idea of an antivirus on Android. The permissions model is such that, at least on the paper, malware filtering is better done on the app repository (Google Play); at least so it is claimed. Antivirus software is useful only as long as it detects malware which would otherwise be disruptive for your device or your data, but such disruption would be considered as a bug on either the OS or the app repository, and promptly fixed by Google. Thus, an antivirus is efficient only insofar as the antivirus vendor and its update policy are more reactive than Google themselves.

share|improve this answer
    
I'm not sure if this should be a separate question, or a comment on your answer, but I'm confused about how Google could claim that malware is being stopped at the app repository, or anywhere for that matter, when all of the articles I read show that the Android platform is by far the most infected platform there is. (Example: zdnet.com/…) Are these articles wrong, or is Google wrong, or am I just misunderstanding something? –  David Stratton Mar 8 '13 at 19:17
1  
Well, I assume that Google would never claim that Android is a scum-ridden hive of malware... note that their claim is from two years ago. A lot of things can change in two years. Possibly, infected Android devices are devices where apps from shady sources were installed. The core idea remains: there is little reason to believe that any given antivirus running on the device will be more efficient at detecting virus than what Google runs on Google Play. So, as long as you only install from Google Play, you have the best possible protection (but "best" does not mean "good" !). –  Tom Leek Mar 8 '13 at 19:28
    
So are you saying that Antivirus apps mainly check for dangerous combinations of permissions? Not sure I understand the answer to how anti-virus apps work. Assuming a stock, non-rooted device. –  dudebrobro Apr 2 '13 at 12:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.