In 2011, Android’s open app ecosystem raised a question that IT teams in Asia-Pacific still ask: how can a user tell whether an app is legitimate before installing it? Google’s model let developers publish widely, and the checking fell largely to users and the businesses that issued their phones.
The core checks have changed little since then. Look at what the app asks for, who made it, where it came from and what scanners say about it. The tools around those checks have changed a great deal.
Why the problem mattered
Gadget Hacks has described Android as having a “bad app” problem, because Google lets any developer upload an app to the Play Store whether or not it works or could harm users. AVG notes that Google reviews apps before adding them to the store, but malicious ones still get through and can collect millions of downloads before removal.
Store vetting has been tested directly. In 2012, researchers presented work on bypassing Google’s Bouncer vetting system at Summercon in June and at Black Hat in July. The US National Institute of Standards and Technology (NIST) lists those talks in its Mobile Threat Catalogue under “App Store Vetting Bypass”, where it warns that apps able to evade an app store’s analysis can plant malware in a legitimate store.
What to check before installing
Permissions
The most consistent advice concerns permissions. MakeUseOf says a request is suspicious when the app has no feature that needs it, and gives the example of a solitaire game asking for the microphone, which would make sense in a video editor. It adds that the most sensitive requests are those covering location, stored files, calls, text messages or audio.
NIST’s catalogue recommends that enterprises teach users to scrutinise requested permissions, particularly when an update asks for significantly different ones than the previous version.
Permission handling itself has changed. Gadget Hacks notes that older apps request permissions in bulk at installation, which means a user either accepts everything or does not install. Under the newer system, which AVG says applies from Android 6.0, users can review and revoke permissions app by app, although this may break the app.
The developer and the listing
MCP Insight advises checking that a developer looks genuine. That means reading reviews of the developer and of their other apps, visiting their website and confirming that the contact email on the store page belongs to them. Avast adds that an app’s privacy policy link should lead to a real policy, because a link on the listing does not guarantee the page still exists or is relevant. AVG says a high download count makes an app more likely to be legitimate. Its own warning about malicious apps collecting millions of downloads shows that this is only a weak signal.
Signing and scanning
MakeUseOf explains that Android developers must sign their apps with cryptographic keys. This lets a device confirm that the software has not been tampered with and comes from the developer who signed it. The same article suggests running a link or file through VirusTotal, which checks suspicious files, URLs, domains and IP addresses for malware.
What Google’s own checks do now
Google Play Protect now carries much of this work. MCP Insight says it checks apps from the Play Store before download and periodically scans installed apps. NIST’s catalogue also lists Android’s Verify Apps feature for users as a way to shorten the time it takes to detect malicious apps.
PhoneArena reported that Google said Play Protect scans 200 billion Android apps every day. The same report describes a live threat detection feature announced at Google I/O, which monitors apps’ requests for sensitive permissions and how they interact with other apps and services. If it finds something suspicious, the app is sent to Google for review and the user is warned. Google then disables the app if the review confirms it is malicious. The scanning runs on the device using Google’s Private Computer Core, which Google says lets it protect users without collecting data.
Common mistakes
- Treating a store listing as proof of safety. Both AVG and NIST record cases where vetting was bypassed or missed malicious apps.
- Accepting a long list of permissions because the app is popular.
- Ignoring changed permissions in an update.
- Installing files from outside the store. FreshTechTips says legitimate apps do exist outside the Play Store, such as F-Droid builds and beta programmes, but these skip the Play Protect check applied to store installs, so they need scanning and verification first.
For organisations, NIST recommends vetting apps with app-vetting tools or services before authorising their use, and using threat intelligence services to find malicious apps already installed on devices.