Google to auto probe Android Market for malware

An answer to malware and rebuttal to calls for it to vet apps first.

Google has unveiled Bouncer, its answer to the growing threat of maliciously laced software available on the Android Market.

Bouncer will provide automated malware scanning of Android Market, but Google will not be bowing to calls for it to follow Apple in implementing an approval process for each application on its market.

Apple's mysterious vetting process is arguably one of the main reasons why there remains few if any cases of iOS malware available for download on the App Store.

However, Apple's process could also slow down the release of apps and provide obstacles to building the largest ecosystem. Security researcher Charlie Miller recently detailed some of those challenges during his efforts to bypass Apple's code signing process, which he did, landing him a one year ban from its developer program.

"Here’s how it works," Google's vice president of Android engineer, Hiroshi Lockheimer explained. "Once an application is uploaded, the service immediately starts analysing it for known malware, spyware and trojans."

It will also conduct a behavioral analysis of the app by running it in Google's cloud and comparing it against previously analysed apps to detect anything that might be considered untoward.

"We also analyse new developer accounts to help prevent malicious and repeat-offending developers from coming back," Lockheimer added.

While security vendors across the board reported a huge surge in Android malware throughout 2011, Google's own analysis showed a 40 per cent decline in "the number of potentially-malicious downloads from Android Market."

In other words, Google is saying there might be malware there, but people aren't necessarily downloading those apps.

"While it’s not possible to prevent bad people from building malware, the most important measurement is whether those bad applications are being installed from Android Market - and we know the rate is declining significantly," Lockheimer wrote, noting the drop occurred at the same time as security vendors were reporting a rise in Android malware.

Bouncer follows a controversial rant by Google open source champ, Chris DiBona, which slammed "the charlatans" peddling antivirus apps for Android.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

More about AppleGoogle

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Liam Tung

Latest Videos

More videos

Blog Posts