Android 4.2 blocks premium rate messages and verifies third-party apps
Google has recently released its latest Android version, and the first devices to run it – Samsung’s Nexus 10 and LG’s Nexus 4 – will be released a week from now.
Users have already been informed of the many improvements and new features of Android 4.2, but there hasn’t been much talk of security improvements it will bring – and they are big.
First and foremost, Google has extended the “Bouncer” automated app scanning service to Android devices.
While Google Play’s “Bouncer” works on the server side, Android’s works on the client side and checks – if you want it to – every app you install from a source that isn’t Google’s official Android market.
The feature is opt-in, and the option to use it is given as soon as the installation of the first of such apps is started. Android detects the attempt and asks the users if they want to “allow Google to check all apps installed to this device for harmful behavior.”
If they choose to do so, the feature is automatically turned on. Of course, it can also be turned off from inside the Security Settings.
“We have a catalog of 700,000 applications in the Play Store, and beyond that, we’re always scanning stuff on the Web in terms of APKs that are appearing. We have a pretty good understanding of the app ecosystem now, whether something’s in the Play Store or not,” Android VP of Engineering Hiroshi Lockheimer sharedwith Computerworld, and explained that the device sends to Google’s servers only a signature of the APK that needs to be tested, which makes the identification extremely fast.
If the app is considered harmless, the installation will go on without a hitch. If the testing reveals that the app is definitely malicious, users won’t be allowed to install it.
The third course of action is triggered when the app asks for permissions that could be misused, but there is currently no evidence that it has ever done so. In that case, Android will ask users to decide for themselves whether they want to risk the installation or not.
The second security feature makes allows Android 4.2 to detect and block any suspicious SMS sending initiated by any of the installed apps. User are alerted and can choose whether they will let the app send the message or not.
Given that premium text billing is the most common tactic used by malware writers to commit financial fraud on mobile, this feature is definitely a welcome addition to the OS.
Finally, the app permissions screen has been modified to be easier to read than its previous incarnation – a small change that can make users be more careful when reviewing the permissions.