Hi! This is the Daily Overpass. My name is Eric and I make apps.
Now today, I want to talk about Android Malware.
Okay, so today, I want to talk a little bit about Malware and Android. It's one of the things that
seems to be on the rise. I mean, there was an article in The Next Web a few weeks
ago saying Android malware spreads like wildfire, 350 new
malicious apps every hour and it basically is based on
research by an antivirus software firm called GData, who have discovered that
there have been, you know, that 750,000 new malware infested apps have sprung up
in the first quarter of this year alone. It's gonna be like the biggest
year of malware on android and whenever they talk about security and apps, we
always know- we know it's Android. It's just there's so many people,
it such a big market and such a low barrier to entry that anybody goes
in. And despite the fact that when you put something on iOS, it's
a pain because you have to go through the reviewers and you know, you can't
just put it up there easily. You got all these hurdles you have to go over.
It's usually a little bit more secure because anybody
can't just put anything on there. We've got so used to the fact that
when people ask for permissions we just say, yeah, okay that's fine .And
it's really hard to know like when you add a new
plugin to your browser, they'll say this plugin can see your entire internet
history or everything. All the web pages you look at, but that's- it
could but it doesn't mean it is going to. And one of the things in my apps like
with Ear Spy, I get an email every so often from people saying can
you tell me why Ear Spy needs to access my photos and documents? Hmmm?
And I say well, it's because we don't access those photos and
documents basically. We write - we have the feature we can record MP3s that
we need to write to that directory, so we create one folder and we just
write to that folder, we don't really look at anything else. But that's not
what the permission says so it's really difficult and people are getting
more and more and more skeptical about
the security this kind of thing. Every time there's a new story like that comes
out, people get more suspicious. And it leads me to think about what
do we do in the future in terms of AO Marketing our apps to Android. I mean, one
of the things that I did with Ear Spy after I read an article like
this a couple years ago, I put this little part in the app description
saying we don't spy on you, as with the exception of analytics, I don't have any
information about you guys. But that still doesn't you know, occasionally
people say, oh, you know, it has a virus or it's got all this kind
of stuff in it but it doesn't. Because I only use AdMob. This is one
of the- yeah I have one app suspended or actually two app suspended and they'd
said that I add malware in it. It was my -two spy apps. And they
only suspended the free ones. They left the paid ones in place. I
thought it was you know, I would have thought it was because of the content,
but in the end, with the description they gave, they said an included
malware. And back then, I would just use whatever ad network I know,
trying all the different ad networks, you plug things in, try not, try this gun
stuff. And because that happened, all you know, since then I only use AdMob.
Or occasionally, I'll use like other ad networks that are offered
through AdMob mediation. And even then, it's not that much. I've told
you guys before, how I get contacted a lot by companies that they work for, so
they might have an ad network that nobody's ever heard of, which is
really hard like I'm not gonna put something in my app that I've
never heard of. Despite all the sales people who call me and
sometimes, I'll have like people call me say, you know, yeah we would like-
we would like Ear Spy include our SDK and you can earn $10 eCPM without
even have to display ads. And I look at that thing and I spoke to one of
them and they said, oh no it's based on for marketing research data, all the
data's anonymous, all we need is access to your microphone. That and I
thought, no, it was like and it turned out I would be making-
I would be making an extra thousand dollars a month. It
was like- and I have to tell you it was tempting, but it was just so, so dodgy.
I mean, it was just something about it just didn't sit well with me. I'll try to do a
little bit of research on the company. They had a nice looking website.
Yeah, the salesman, it wasn't like- it didn't sound like- it didn't seem
like a dodgy thing when a Salesman calls you up because you think it's not he's
gonna, "Hey man, put my SDK in your app. Come on, man, do it." I was like, oh, you
know, we've got lots of clients all this go, we did all this up, you know
I asked him to tell me about some of his clients and they said, well they
don't really like to be known. I don't want you know, I just
didn't want a part of it. I think in the future we're going to have to be a
little bit more careful about security. It's something we have to think when
we're marketing your apps and also when we add new permissions.
Another thing with ad networks always ask me, is the first deal will
say, oh you can make- they'll give me a high eCPM number or you know
it's like you twelve, $12 eCPM or whatever. And then I'll
ask a few more questions, the first thing I ask is what
permissions does it need because I'm not adding any more permissions into my app.
But I have enough permissions already. I have location, I have things
that I don't need, but the ad networks need. There's one of the things that
people are you know suspicious about to. They go why does this app need my
location? Well, it doesn't, but I have an ad network.
And the ad network needs your location. If you go get the paid
version, it doesn't need that. And it's just -it's really, really-
back in the early days of Windows, it used to be like you used to
be able to send an executable. I mean, that was one of the things working in an office
environment is that you would send your friend a little game like an
executable and they would play it you know at their desk or they'll
send something that like, a little joke file where it would be a little
executable and it would say, hey I'm watching porn over here. Okay, I can't
believe I opened that. But then, viruses became really really big.
And you know, and then it was almost like Windows was just
opening everything up, making the office suite be able
to do everything, access all parts of the computer. They
were trying to make office like a Word document, be able to do everything like a
programming language. But then as security, as viruses starting to get more
prevalent then everything had to start locking down. And now you can can't
hardly send anything on an email anymore. You have to zip it five times and
or maybe put it on a Dropbox or you just can't send an email anymore because
everything's getting locked down. So been interesting to see how things go with
the Android Market this way, and whether or not we're going to have to
start thinking about security more often. And also you know, when you look at some
of the apps that are out there, some of them do look really dodgy. I mean, if
I'm getting a phone for my kids, well we'll get Android because you know
because I like Android. I'm an Android user. Normally I'm gonna have loads of
devices, but my phone of choice is an Android phone. But
when you look at the App Store, some of the stuff out there is- uhm- it just
doesn't look very reputable. Anyway, I'd like to know what you, guys,
think of it. Have you guys experienced malware in any way like that? Because the
only way I could think of that it would get into your code without you
knowing about it, is if it came through an ad network like that. That's the
only way I think, unless you have a virus on your computer. But you know, I
mean, how rare is that a virus on your computer will work its way into the code
of your app, and then get distributed that way. So you know, I'm really
curious as if whether or not you guys have had any problems with this kind of
stuff. Let us know in the comments. Anyway, that's it for today.
I'll talk to you, guys, tomorrow.