Android Security Update

"Stop. Think. Connect.”

That is the cogent slogan (for which many tax dollars were spent, no doubt) of DHS’s ongoing nationwide campaign aimed at “increasing the understanding of cyber threats and empowering the American public to be safer and more secure online.” Your cooperation is only technically optional; it is “a shared responsibility” of all good citizens. And if you’re not a good citizen, I suppose the NSA will know.

Another government agency, The Federal Communications Commission, is doing its part in the Stop.Think.Connect campaign. The FCC has made available on the Web a Smartphone Security Checker service. Just select your device’s operating system and the FCC will check it for vulnerabilities. Right? Actually not. All you get is a list of tips to help you check it yourself. The tips, which are customized for Android, Apple iOS, BlackBerry, and Windows Phone users are worth a read, though.

And this just in… a U.S. Army Cyber Crime Flyer is warning all and sundry of attacks specifically targeting Android devices. The Army’s bulletin takes the form of a PDF file because Adobe software has (cough) never, ever been compromised by malware. Well, not this year, anyway.

To put it very simply: don't follow the advice in any ad, popup, email or text message you receive that urges you to download an “update” to your Android operating system. Do not follow its instructions to click and automatically download the “update.” That is not how legitimate updates from your mobile service provider work. It will only get your device infected with malware that gives the attacker complete control over the device.

But that's not to say that you shouldn't be careful, especially when dealing with your financial information online. I recently came across a guide called 17 Security Tips for Smarter Smartphone Banking which is a good read.

Just Drive On By…

Companies that market anti-virus software for desktop PCs have touted their products as an important defense against "drive-by viruses" that automatically download themselves and infect a computer, simply by visiting a web page. These same companies must long for the day when a similar threat exists for mobile phones and tablets.

I say this because Lookout Security, a mobile security vendor, has claimed that their software will protect against such threats, even though none exist. In the scenario that Lookout discusses, a file can be auto-downloaded to an Android device, but it's not installed without the user's help. Further, the malware can only be installed if the user has modified their phone's settings to specifically allow software to be installed from unknown sources. (That's one of the no-no's mentioned in the FCC tips above.)

I've discussed the issue of security software for mobile devices in Do You Need Mobile Security Protection? That article also talks about how to protect yourself from malicious apps, so I recommend that you check it out if you use your smartphone for anything other than making phone calls.

Your thoughts are welcome on the topic of security for Android smartphones and tablets. Post your comment or question below...