hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015Android anti-malware marketSince the discovery in August 2010 of the first malware for Android, Google’s approach toallowing security apps for Android was very different from Apple’s. While Apple exposed verylittle data that could be used for inspection and on-device malware classification and wasactively discouraging development of security software for iOS, Google took a more hands-offapproach and allowed anti-malware vendors to develop anti-malware software and publish itto Google Play.However, a decision has been made that anti-malware apps on Android will not have any specialprivileges. As a result, unless the device is rooted, anti-malware apps are unable to preventinfection, but can only detect the installation of malicious apps onto the device and open astandard Android dialog that allows the user to remove the detected app.APIs used by anti-malware solutions on Android are available to any apps allowed to listento events triggered by the operating system when apps are installed. That may be one ofthe reasons for the large number of Android AV offerings—over 300 alleged anti-virus andanti-malware apps are currently hosted on Google—including all the traditional vendors withsignificant market share in the world of desktop anti-malware.Nevertheless, awareness around the existence of security software for Android is relativelylow. While we can expect more than 90 percent of Windows systems to be protected by securitysoftware, the overall protection level of Android devices is lower. We estimate that just below40 percent of Android devices have some kind of anti-malware solution installed (based on thenumbers displayed by Google Play market), which may be a bit low considering that the numberof malicious apps for Android discovered daily is close to the number of Windows malwaresamples discovered around 10 years ago.Meanwhile Google is not encouraging reports coming from anti-malware vendors, claiming thatonly 0.0001 percent of devices may ever encounter a malicious app. 100 That claimed numberis backed by the data collected by the Google Play app. On the other side of the spectrum,vendors such as Kaspersky are reporting that the rates 101 of malicious apps are severalorders of magnitude higher on Android devices protected by their own software. The disparitybetween Google’s and other vendors’ data may arise from the fact that Google only measureddownloads from Google Play market, while other vendor reports account for installs from allsources.According to av-test.org, current anti-malware products for Android, although being ratherrudimentary in terms of available technology and detection techniques compared to theirWindows counterparts, are quite effective against known Android malware, with detection ratesover 99 percent 102 achievable by the majority of reputable vendors.At the same time, with the release of Android 4.2 Google included its own Verify Apps antimalwarefeature into the Google Play app. Verify Apps is an app scanner; it started as a simplefeature that used SHA1 checksum calculation and cloud (Google Safe Browsing) API lookupto check apps for known-malicious samples during installation. With the release of AndroidLollipop (5.0), Verify Apps has evolved more sophisticated protection mechanisms. Theseinclude re-scanning of apps after they are installed, as well as scanning of apps outside theGoogle Play market. We can expect that the Verify Apps functionality will develop into a fullyfeatured anti-malware product, which will certainly be welcomed by Android users and thesecurity industry.100http://www.infosecurity-magazine.com/news/google-android-malware-threat-is-vastly/.101http://media.kaspersky.com/pdf/Kaspersky-Lab-KSN-Report-mobile-cyberthreats-web.pdf.102http://www.av-test.org/en/news/news-singleview/32-protection-apps-for-android-put-tothe-test/.35