An important feature is the real-time scanner which checks new apps during the setup process.
Similarly to antivirus programs for Microsoft Windows, mobile security apps for Android use a number of different protection components. It protects the user against the inadvertent installation of malicious apps on his/her device. The most obvious component of a mobile security app is the malware scanner. In this section we give a short overview and discussion of common security-related components found in security products for Google Android. As mentioned in previous reports, if a phone has been encrypted and set up properly with a lock screen, it is virtually impossible for a thief to retrieve any data from it. It should be noted that all of this relates to a rather a theoretical problem. Without removing associated accounts from the phone, emails and the Google Play Store might still be accessible. Such a wipe has the advantage that all sensitive data can be removed from the phone without losing the ability to control the anti-theft features provided by the installed security app. Obviously such limitations can be regarded as enhancing the security of Android, as such potentially destructive operations are denied by the system, but with previous Android versions this feature was used to perform a data-only wipe by many security products. Only accounts which were created by the app itself can be removed. With the new API, apps can’t remove accounts (such as the main Google account) from the phone. But if the user were to do so, a well-implemented app would simply request this specific permission the next time it was used.Īdditionally, a small but relevant change for security apps was introduced with the new API level 23, related to the account management. Obviously revoking the Camera permission from the Camera app will make the app useless. Even though it may be possible to remove some individual permissions from an app after it has been installed, the app is not guaranteed to work properly if this is done, and might just fail completely when attempting to perform an action for which permissions have not been granted.Īs seen in the screenshot on the right, single permissions for an individual app can be manually granted or revoked from within the Android app settings. Apps which are designed for an older version of Android will still ask for all-or-nothing permissions on installation. This gives the user the opportunity to grant an app only the specific permissions which he/she wants it to have. An app designed for the new system will ask for a specific permission the first time it needs it. The new permission-management system in Android 6 introduces individual post-installation, run-time permission requests. Detailed reviews of the individual products follow, in which we will shed light on the layout and usage of the features.
After that we give a short summary of commonly implemented security features and their main sub-components.Īt the end of the introduction we summarise the participating security products and present the results of the Malware and Battery Drain tests.
We start by introducing Android Marshmallow and its new permissions system, and mention the restrictions in the operating system that security vendors have to deal with. On the following pages we provide a brief overview of the risks facing smartphone users from malware and the loss or theft of their device, and discuss the benefits of security apps. Amongst other things, this report aims to help readers decide whether they would benefit from the more comprehensive and sophisticated security features provided by a third-party security app. More details of the security measures in Android Marshmallow are provided in the next section. Basic anti-theft features (lock, locate, wipe and alarm) are provided by recent versions of Android itself. Google’s Safe Browsing API checks apps on installation, and protects against malware and phishing links when the user is surfing the Internet with the Chrome browser.Īdditionally, an anti-theft component in a security app could be used to retrieve a lost or stolen phone, and/or prevent access to any personal data stored on the device. Readers should note that recent Android versions incorporate some basic anti-malware features.
The main purpose of a mobile security product is to protect users and their devices from potential harm inflicted by malicious apps. The structure of each product report is identical, allowing readers to compare products easily. The review will focus on the security features – anti-malware, anti-theft and privacy – and only mention any other functionality briefly. Many of the products reviewed and tested have components which are not security-related.