By JR Raphael (@jr_raphael)
Android malware is always a hot topic, and today, Google is ready to put out the flames.
Google has just unveiled a new security system for the Android Market. Codenamed "Bouncer," the system automatically scans apps in the Market for potentially malicious software. It digs into each app's code to look for known malware, analyzes the app's actions to identify unusual behaviors, and compares the app to previously analyzed programs to detect any known threats. It also scans the developer's account to search for signs of past problems.
Bouncer does more than just an under-the-hood analysis, though: The system goes as far as to run every app submitted to the Market on a cloud-based device simulator in order to see how it performs and root out any hidden agendas. And in addition to scanning newly uploaded apps, it continuously analyzes existing apps in the Android Market, keeping tabs on the entire catalog.
With the ever-present cries of "malware danger" by the various security software vendors -- like this month's silly scare campaign by Symantec, which the company eventually backed down on amidst criticism from the Android community -- the notion of an internal scanning system for the Android Market seems particularly relevant. In fact, while the security software vendors have been reporting eye-catching increases in Android malware levels, Google's own scans have detected just the opposite: Google says its Bouncer system (which has been quietly running while under development since last year) actually found a 40 percent drop in malicious app downloads from the Android Market between the first and second half of 2011.
I had a chance to chat with Android VP of Engineering Hiroshi Lockheimer about the new malware-detection system, the state of Android security, and the future of mobile-based threats. Here's an edited version of our conversation.
JR: Explain to me what exactly Bouncer is and how it came to be.
Lockheimer: Security has always been an important aspect of Android. A lot has happened on the device in terms of the core OS, and this service is another piece of the puzzle. I almost think of it as an insurance policy -- you know, [the Android Market] has been a safe place, and here's an opportunity for us to implement some technology to make sure it continues to be a safe place.
JR: How long has the technology been in place?
Lockheimer: It's been a number of months that it's been running. We've been monitoring its progress and monitoring its efficacy.
JR: What made you guys decide to implement this kind of system now?
Lockheimer: We're always looking for more ways to ensure that Android continues to be secure. It just felt like a natural place -- here's the Android Market, which is something that we have developed and we run, and there's an opportunity for us to put more insurance policies in there. There's a long list of stuff that we're constantly thinking about to make sure the ecosystem remains safe.
JR: There's an interesting discrepancy between the malware trends you've noticed and some of the stats security software vendors have been reporting. What do you think is going on there?
Lockheimer: I don't really want to speculate on how they're coming up with their numbers. We know what we know, which is what's happening with the Android Market. We've observed that it's been a secure place and that it continues to be secure, [growing] even more secure, based on our numbers.
JR: We've seen a lot of conflicting information about Android and security over the years. In reality, given the platform's inherent security systems and now the new Bouncer technology on top of that, how big of a threat is malware to a typical Android user? Is it something people need to actively worry about?
Lockheimer: I don't think so. Security has been at the core of our design, and the reason is that we know it's really important. One of the things about security is that it's something we don't want people to have to think about. It should be assumed that things are secure -- it has to be that way. I don't want my mother, for instance, to have to worry: "Oh my God, is this application going to be safe or not?" She just wants an application and she should be able to install it. I think we've accomplished that.
JR: Looking ahead to the future, how do you see mobile-based threats and Google's approach to Android security evolving?
Lockheimer: We continue to monitor what's happening in the industry and in the ecosystem. That's one of the technologies that we built into this [Bouncer] service -- this continuous scanning that we do. So as we learn more and as technology improves, the service will improve as well and adapt to what's happening out in the wild.
JR: All considered, right now, do you see any real reason for a user to run "anti-malware" or "security scanning" software on his phone? Is that layer of protection needed with everything that's already in place?
Lockheimer: I don't think so. Let's put it this way: I don't run those apps. That's obviously an individual choice, but I haven't felt the need for it.
JR: Anything else about today's announcement that you wanted to mention?
Lockheimer: I want to emphasize that this is one piece of our overall security story. It doesn't start and end here. It starts with the device. It's not just about the app -- it's the sandboxing, the [analyses of] developer accounts, and the scanning that happens. We're going for an end-to-end security path. Open source and security are not mutually exclusive.
(Author's note: Sandboxing refers to the way Android isolates applications into individual compartments so they can access only a limited portion of your data, based on the specific permissions they've been granted.)
SEE ALSO: The Android malware monster is coming! RUN!!
JR Raphael writes about smartphones and other tasty technology. You can find him on Google+, Twitter, or Facebook.
Article copyright 2012 JR Raphael. All rights reserved.