Well, for a few months we’ve been hearing bad news about the degree of penetration of Android apps with malware primarily designed to steal personal information. That occurred because Google chose not to be the “gatekeeper” and have very strict control over the apps being uploaded like Apple.
"We've chosen not to be the gatekeeper," Alan Davidson, now former director of public policy at Google, said during a May, 2011 hearing on location tracking. "We don't generally go back and try to make sure that every app does what it says it's going to do. [Google is] really trying to maximize the ability of small app developers to get online."
I disagree. Your primary responsibility is to your customer’s security, not to some hypothetical dev. Google can well afford to set up workshops online for devs, if it’s that concerned. In a toss up between identity theft and a hypothetical developer, the magnitude of consequences to the customer far exceed those to the dev, and Google just didn’t get it.
Juniper Networks revealed that between July and November 2011, Android malware jumped 472%, but that malware downloads dropped 40% between the first and second halves of 2011, according to Google.
In every black cloud, there’s supposedly a silver lining: At least for MS there was – they offered a free Windows 7 phone to anyone who had been ‘malwared’ by an Android phone. Since their phones aren’t selling like hotcakes exactly, this seems a bit less than altruistic. Still, if you were burned, it’s a decent offer.
Anyway, Google is mending its ways, apparently. Yesterday they added security to their Android market with “Bouncer” which will scan the apps for evidence of malware.
According to Hiroshi Lockheimer (V.P. Google Engineering):
"Here's how it works: once an application is uploaded, the service immediately starts analyzing it for known malware, spyware and trojans," Lockheimer wrote in a blog post. "It also looks for behaviors that indicate an application might be misbehaving, and compares it against previously analyzed apps to detect possible red flags. Google said it runs every app in its cloud infrastructure to simulate how it might work on an Android device to look for anything fishy. Developer accounts are also scrutinized to guard against banned individuals making a reappearance." -http://www.pcmag.com/article2/0,2817,2399778,00.asp
Better late than never? I think they owed their customers a lot more from the get go, myself.
Source:
http://www.pcmag.com/article2/0,2817,2399778,00.asp