Google's Play Store Identified as Main Distribution Vector For Most Android Malware (zdnet.com) 27
The official Google Play Store has been identified as the primary source of malware installs on Android devices in a recent academic study -- considered the largest one of its kind carried out to date. From a report: Using telemetry data provided by NortonLifeLock (formerly Symantec), researchers analyzed the origin of app installations on more than 12 million Android devices for a four-month period between June and September 2019. In total, researchers looked at more than 34 million APK (Android application) installs for 7.9 million unique apps. [...] The results showed that around 67% of the malicious app installs researchers identified came from the Google Play Store. Google did not respond to a request for comment made by ZDNet almost three weeks ago.
So Apple 30% worth it? (Score:1)
No?
Re: (Score:2)
No?
Since the downloads rage on, wake me when an Android developer starts giving a shit about impact.
Re: (Score:3, Interesting)
When it is the main channel of apps, that's expect (Score:3)
How could it be otherwise?
Re: (Score:2)
Since it is the main channel for all Android apps, of course it will be the main channel for bad apps.
How could it be otherwise?
I know, right? Did we miss TFA subtitle that says, "Duh" -- or is that buried in the conclusions section somewhere?
Re: (Score:3)
The point is that the whole concept of the walled garden was to protect people from malware. Clearly, that concept has not had the desired effect, though it still gets a 30% cut of sales for a broken promise.
Re: (Score:2)
Except Google Play was never a walled garden. Or have we gotten to the point where people can't tell iOS from Android?
Basically, while Apple reviewed apps, Google let everything and anythig into the Play Store. This has the expected result where the Play Store ended up with a store full of malware.
Googl
Re: (Score:2)
Basically, while Apple reviewed apps, Google let everything and anythig into the Play Store.
This sounds more like Apple propaganda than reality, on both sides. Apple "reviews" apps, but having managed a team that created iOS apps, I know that that "review" is haphazard at best, and serves mainly to prevent app developers from using other payment mechanisms. iOS certainly has less malware than Android, but an analysis of the data does not point to Applie's reviews, but rather, to Apple's closedness. https://www.pandasecurity.com/... [pandasecurity.com].
Google's reviews are more automated, but their openness is both th
Re: (Score:2)
Re: (Score:2)
You make some good points, but I don't understand this statementa;
But I call BS on closedness - because if that was true, Windows would be the most secure OS ever, with Linux being the most exploited.
In what way is Windows "closed"? Any developer can write code for it, and distribute it without even notifying Microsoft. They can send apps through email if they want to.
Perhaps its the definition of "closed." I didn't mean closed as in closed-source, but closed as in closed walled garden. In that respect, Windows and Linux are the same, there is no walled garden. Linux avoids most malware mainly because the user base is simply too small to
Re: (Score:3)
Most Serial Killers Eat Bread, Etc (Score:3)
Re: (Score:2)
I would've guessed that there are probably Chinese or Russian language app stores that might have been more prevalent sources of bad software.
Re: (Score:2)
I would've guessed that there are probably Chinese or Russian language app stores that might have been more prevalent sources of bad software.
research proves baseless and biased guesses wrong. who would have thunk!
Where? (Score:3)
I wonder where the 12M devices were from. The level and sources of malware differ pretty dramatically around the world. If these were North American or European devices, then the numbers make sense. Most devices in those regions only use the Play store, so even though the amount of malware distribute by the Play store is very small, most of the malware will be from the Play store. Actually, making these numbers at all meaningful requires knowing how many devices used each installation mechanisms; without that there's a strong potential for a Base Rate fallacy error.
Another source of potential bias is that this data clearly comes from devices whose users chose to install NortonLifeLock. In what ways they may differ from the general Android population, I can't say.
Primary source (Score:2)
Breaking news. The primary distribution mechanism for all Android apps is also the primary distribution of malware.
Re: (Score:2)
The other possible alternative--the one the app stores would like you to believe--is that malware comes from side-loading.
Re: (Score:2)
If I read the table correctly, 0.6% of the software from the playstore was malware. That's compared to 2.4% from pkginstaller (is that sideloading?) So, you have a 4x chance of getting malware if you sideload instead of getting software from the playstore.
So yeah, when you say that "malware comes from side-loading", I'm gonna have to agree with you.
Re: (Score:2)
I believe you are reading the table correctly. But it's like saying that antique cars pollute the air 100 times worse than modern cars. This is a true statement. But because antiques are so seldom driven, their contribution to air pollution is minimal overall. If we want to reduce air pollution, it would not make sense to go after antique cars. In the same way, it doesn't make sense to blame side-loading for malware, since the overall contribution to the malware problem is tiny (0.7% vs. 87%, according to t
Whoa There! You Mean! (Score:2)
Who knew?
Don't worry, Epic (Score:3)
Soon Google will make it easier and less restrictive for you to make your own app store, and YOU can be top of the malware heap.
Thank god I got a Huawei Phone.... (Score:2)
And to think at first, I thought having Google Apps blocked was a bad thing.
Now I find out HMS is the only clean source of Android apps.
Shocked, I am shocked to discover gambling here! (Score:2)
The obligatory joke was missing, but I guess I'm more shocked that the apparent interest was so small on Slashdot. This will be the 21st comment as the story expires.
Sponsored research, biased? Noooo... (Score:2)
...and of course now Norton will be claiming you just absolutely must give them money to protect you from the Android Play store, because correlation always equals causation.
Here's another analysis for you. More than 98% of all Android infections are caused by users installing software.