In the OWASP MASVS it says:

Smartphones are like small computers, and mobile apps are just like classic software, so surely the security requirements are similar? But it doesn’t work like that. Smartphone operating systems are different from Desktop operating systems, and mobile apps are different from web apps. For example, the classical method of signature-based virus scanning doesn’t make sense in modern mobile OS environments: Not only is it incompatible with the mobile app distribution model, it’s also technically impossible due to sandboxing restrictions.

What is the reason that the use of signature-based virus scanning makes no sense and is technically impossible?

1 Answer 1


You left out the caveat at the end of the paragraph exceptions apply.

At a high level the author is saying that a non-rooted Smartphone using PlayStore/AppStore is a) unlikely to have a virus/malware (i.e. makes no sense) and b) a virus scanner wouldn't be able to scan a sandboxed application (i.e. technically impossible).

Your mobile device is unlikely to have a virus/malware because Google, Apple, et al. take precautions about what is available in their app stores. Occasionally a misbehaving application will sneak through but they are quickly dealt with.

You might occasionally hear about some “malware” apps in the Play Store, usually related to information harvesting or advertising shenanigans. Google deals with these quickly, but anti-malware apps won’t catch this sort of thing.

With regard to technically impossible, Apple for example provides, sandboxing, the use of entitlements, and Address Space Layout Resolution (ASLR) that makes it impossible for a virus/malware scanner to work on a mobile device.

Apps that claim to scan your phone for viruses will not work on iPhones. That’s because Apple’s operating system, called iOS, doesn’t permit any one app to see what any other app is doing, or even to “know” of another app’s existence. That means you don’t have to worry about your fitness app ever gaining access to your banking records. The only way one app can ever communicate with another is if you enable permissions, like allowing a journaling app to access your photos, for example. With this “sandboxed” approach, there’s no way a security app could possibly scan other apps on your phone for malware.

Android devices are a little more promiscuous and you can grant scanners the ability to see file systems etc. although if you're phone has not been jail-broken the odds of you having a virus or malware is very small.

Security of runtime process in iOS and iPadOS
Android Antivirus Apps Are Useless -- Here's What to Do Instead
iPhone Security: Does an iPhone Need Antivirus Software
Does Your Android Phone Need an Antivirus App

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .