According to new research done by Bit9, One-quarter of more than 400,000 Android apps examined in the Google Play store pose security risks to mobile-device users.
Security vendor Bit9 categorized these Android apps as “questionable” or “suspicious” because they could gain access to personal information to collect GPS data, phone calls or phone numbers and much more after the user granted “permission” to the app. “You have to say ‘yes’ to the application or it won’t run,” pointed out Harry Sverdlove, Bit9 CTO.
Bit9 claims that games, entertainment and wallpaper apps especially seem to want to grab users data, even though their functions would seem to have little direct use for that data. Bit9 notes this doesn’t mean these apps are malware per se, but they could do damage if compromised because the user has granted so much permission.
Bit9 is now compiling a “reputation” database of Android apps, according to Sverdlove. The firm is also going to move on to other app stores, including those from Apple and Amazon, in order to create mobile security products that can protect users based on risk-scoring of apps.
Bit9 categorized these “questionable” and “suspicious” apps it found in Google Play below:
• 42% access GPS location data, and these include wallpapers, games and utilities
• 31% access phone calls or phone numbers
• 26% access personal data, such as contacts and email
• 9% use permissions that can cost the user money
Bit9 looked through Google Play to collect detailed information about 412,000 mobile apps, including publisher, popularity, user rating, category, number of downloads, requested permissions and price.
Of the 412,222 Android apps evaluated from Google Play, Bit9 says more than 290,000 of them access at least one high-risk permission, 86,000 access five or more and 8,000 apps access 10 or more permissions “flagged as potentially dangerous.” The report defined risk level according to relative degrees of privacy intrusion and the app’s feature set.
The study also included a survey of 138 IT professionals responsible for mobile security for over 400,000 users in their organizations. Below are the results:
• 78% think phone makers do not focus enough on security, but 71% allow employee-owned devices to access their organization’s network.
• Only 24% deploy some form of app monitoring or control to grant visibility into employees’ devices.
• 96% allowing personal devices also allow employees to access email using the device, while 85% allow access to company calendar data.
• 84% feel Apple iOS is “more secure” than Android and 93% of respondents allow iOS to access their network. Only 77% allow Android devices, and in something of a surprise, 13% say they allow rooted Android or “jailbroken” iPhone devices onto their networks.
Source: Network World