Do You Need Mobile Security Protection?

Anti-Malware Protection for Your Smartphone or Tablet

Malware targeting mobile operating systems is on the rise. Security firm McAfee Labs says its count of mobile malware programs has risen from about 1,200 in 2011 to over 20,000 in 2012. Mobile malware is just as sophisticated as its desktop brethren, too. "Mobile threats already take advantage of exploits, employ botnet functionality, and even use rootkit features for stealth and permanence," according to McAfee's mobile threat report.

Notably, no iPhone or iPad malware has been detected yet. McAfee says, "It is probably a matter of 'when' rather than 'if.'" But the fact that Apple closely vets and controls the apps that make it into the Apple App Store undoubtedly makes it difficult for malware authors to sneak their wares in. But the popularity of Android smartphones and tablets has resulted in a flood of Android malware.

Google Play is the official source for downloading Android apps, and for the most part, these apps are safe. If you have a Kindle, the Amazon app store is another trustworthy source. Both Google and Amazon proactively go after apps that are identified as malware. They can be removed from the market, and even remotely zapped from devices that have them installed.

Who Benefits From Mobile Malware?

Mobile malware aims to make money, of course. One straightforward scheme is malware that secretly subscribes the infected device to premium SMS services; every text message sent or received costs the user money. This type of malware may be concealed in another app such as a calendar or game. Each time you add an appointment or kill a robot, a text message is added to your monthly bill. Other forms of mobile malware may log passwords, steal financial data, and so on.

Some of the mobile malware apps currently circulating are "trojanized" versions of legitimate apps. These apps have been cracked by hackers who add malicious code, then re-release them to app markets. Typically, the original functionality of the app is left intact while the new malicious functionality goes completely unnoticed by users. The intention is to dupe users into thinking they are downloading the legitimate app, when they are actually getting the app plus malware.

As you might expect from the foregoing, there's a booming market for Android anti-malware solutions. All of the major security vendors are rolling out mobile anti-malware apps. Avast!, Kaspersky, Lookout and McAfee are just a few well-known names. As mobile computing grows, so will mobile malware and mobile anti-malware.

But Do You Really Need It?

So do you need mobile anti-malware protection? If you have an iPhone or iPad, I'd say definitely not. One caveat to that would be "jailbroken" iOS devices. If you hack your phone or tablet in order to enable downloading apps from sources outside of Apple's App Store, then all bets are off.

But what about those with Android phones? To the best of my knowledge, there are no mobile threats similar to the "drive-by viruses" that affect desktop users. So if your smartphone activity is centered on talk, text, email or web browsing, I don't see a risk that warrants anti-malware protection. Techniques such as Address Space Layout Randomization (ASLR) and other security features have been implemented in Android 4.0 (Ice Cream Sandwich) and Android 4.1 (Jelly Bean), in order to reduce the possibility of malware attacks.

But what if you're into apps? Well-known apps such as Facebook, Gmail, Yelp, Angry Birds, Kindle, Weather Channel and others with good reputations are safe to use. And I have not heard any reports about malware in any paid apps. Here are some safety tips for anyone using apps on an Android device:

• Don't download from third-party app stores such as GetJar and Handmark, where oversight is lacking or less stringent. If you're outside the USA, be aware that malware abounds in Chinese app markets.
• Before downloading an app, check the permissions that the app is requesting. If an app wants permission to make phone calls; the ability to send, receive or access your SMS messages; or access to your contacts, calendar or camera, those may be red flags, unless it seems obvious that the app would need to do those things.
• Don't download apps that have been on the market less than a month, and only then if they have several thousand downloads and lots of good reviews.

How Effective Are Mobile Security Tools?

The AV-TEST March 2012 mobile security review found the malware detection results of many mobile security software products rather disappointing. Of the 41 Android anti-malware products tested, only 10 detected 90% or more of known malware samples. AV-TEST will be releasing an updated mobile security report in February 2013.

The September 2012 AV-Comparatives mobile security report showed a more encouraging picture. Of the 13 products tested, all achieved a malware detection 93% or better. Some of the top performers include the mobile security offerings from Avast, BitDefender, ESET, F-Secure, Kaspersky, and Trend Micro. The report includes detailed reviews of all products tested, and is definitely worth reading. Of special note are the discussions of features other than malware detection, such as privacy, theft protection, remote wipe, data backup and parental controls. A final bit of good news in the report was that the performance and battery impact of mobile security tools is not significant.

To summarize, the danger zone for mobile users right now is free apps with unknown or sketchy reputations. Stay away from those and you should be safe. But if your child is likely to download almost anything on your mobile device, or you just want the extra peace of mind, try one of the mobile security products in the AV-Comparatives report above. Some of the best are even free.

Your thoughts on mobile security are welcome! Post your comment or question below...