Android is getting real-time scanning protections during app installs

[harlan4096]

Google announced today that it is improving protections on Android to better protect users against new threats. The enhancement of Google Play Protect addresses threats that come from the installation of new apps from outside the Play Store.

Google notes that Play Protect already includes protections for apps that are installed from outside the main Google Play store. The security service warns users if an app that they are about to install is known to be malicious.

While helpful, it did not take into account new apps and new threats, according to Google. The integration of real-time scanning capabilities "at the code level" adds a new layer of protection for all Android users.

When Play Protect notices the installation of an unknown app, it will recommend to users to scan it. Google notes that this prompt is displayed for apps that have not been scanned before.



The prompt "App scan recommended" is displayed in this case. It displays the name of the application and a brief description why Google Play recommends to scan this app.

Android users may select "Scan app" to initiate the scan or "Don't install app". There appears to be no option to bypass the dialog and continue with the installation of the app on the device.

When Google Play Protect scans an app, "important signals from the app are collected" and send to "the Play Protect backend infrastructure for a code-level evaluation".

Apps considered harmful by the analysis can't be installed on the device. If the scan did not detect any issues, the user is giving the ok to continue with the installation of the app on the device.

Google notes that the security improvement improves protection "against malicious polymorphic apps". In other words, apps that use different methods to alter their code to avoid detection.

The improvement to Google Play Protect is rolling out to all Android devices with Google Play services. The rollout begins in India and will expand to all other regions in the coming months.

Closing Words

The new real-time scanning feature of Google Play Protect may limit the installation of malicious apps from outside the Android Store. While it depends largely on the scanning capabilities at Google, it looks as if it could have a meaningful positive impact on the number of malicious app installations on Android devices.

The new system does give Google control over application installs, on the other hand. This may not be a problem, if only used for the purpose of blocking malicious app installations.
...

Continue Reading