For Android Lookout can scan an app before it is installed, and I think it scans a new app the first time it runs too. It displays the message "this app is safe" and I'm wondering, how does it determine? Does it just check for virus signatures? I'm inclined to think it does more since "this app is safe" sometimes shows up after running an app.
I've very new at Android security, are there any products are techniques out there specific to Android I should be aware of?
Exploits often have very distinct signatures. For example, z4root uses exploits to gain root access to a device. These techniques for privilege escalation can be known to an anti-virus program, an flag any app that contains similar API calls.
Lookout uses some advanced techniques. For example, it can determine the difference between adware, and an app with advertisements.
- Displays advertising outside of the normal app experience
- Harvests unusual personally identifiable information, or
- Performs unexpected actions as a response to ad clicks; appropriate user consent entails providing a clear alert in the application that allows the user to accept or decline before any of the above behaviors takes place
For runtime checks, it can observe dynamically generated content. For example, I could write a malware program that intends to send data to http://evil.example.org. If I hard coded that into the app, it would be flagged by their domain filters before being installed. If I instead set up a server at http://imnotevil.com, that would return a redirect to http://evil.example.org on the third request from an IP, it would need to be checked at run time.
I recommend reading their blog for the various exploits they've discovered.
