The AV-Comparatives researchers studied 250 popular security apps from Google Play’s official catalog and reached disappointing conclusions: nearly two-thirds of Android antivirus apps fail to deliver the features promised in their advertisements. Worse still, some of these apps even flag themselves as malware, fail to “see” real threats, and in fact do nothing useful.
The tests were conducted in a very simple way: the experts installed antivirus apps on separate devices where the browser automatically opened and downloaded malicious apps. This was done 2,000 times with each app, using 2,000 different samples of the “popular” malware found last year. In this case, the word “detected” implies that the antivirus solutions should have been aware of this malware. Unfortunately, in reality, everything turned out to be completely different.
Only 80 of the 250 apps studied were able to recognize at least 30% of threats without false positives. In other words, the other 170 apps “flooded the test”. I must say that only 23 of the 250 apps detected 100% of threats, mainly solutions from well-known antivirus software developers, including Avast, Bitdefender, ESET, F-Secure, G-Data, Kaspersky Lab, McAfee, Sophos, Symantec., Tencent, Trend Micro and Trustwave.
The researchers write that many antivirus apps do not analyze apps downloaded and installed by the user at all, but only check whitelists and blacklists, verifying only package names rather than their code. As a result, many apps are marked as malicious by default, simply because they do not appear on the appropriate list. For this reason, amusing situations sometimes occur: for example, such “antivirus” apps can be flagged as malicious even when their authors forgot to add the name of their own product to the whitelist. Other solutions, on the contrary, consider apps whose names begin with “com.adobe.*” to be harmless. In other words, any malware whose package name starts with com.adobe will bypass the restrictions.
The AV-Comparatives experts write that the fact that many of these antivirus apps are not developed by information security specialists is alarming: they were created by amateurs or by companies whose core business is extremely far removed from information security (for example, game developers). “The last category is made up of developers who create apps of all kinds for monetization and advertising purposes, or who want a security solution for Android in their portfolio,” the experts explain.
Worse still, many security solutions appear to have come from the same “pipelines”: dozens of apps have an almost identical interface, and their creators are clearly more interested in serving ads than in writing a functional malware scanner.
The results of the AV-Comparatives study are unlikely to surprise anyone who has been watching the situation in the Android antivirus market. For example, last spring, ESET specialists discovered 35 adware apps on Google Play, also disguised as antivirus software and downloaded more than 7,000,000 times. ESET analysts called such “duds” malware, merely imitating the work of real protection software.
