I was recently asked about the necessity of anti-virus software on a smartphone. It is was a reasonable question, but one that I didn’t quite have an answer to. Kaspersky has reported some 200,000 unique samples of mobile malware in January 2014; which certainly looks like an extremely dangerous trend. Yet, security against malware doesn’t appear to be very high on the list of priorities of smartphone users.
Understanding the threat is necessary in overcoming it, and mobile malware doesn’t quite function in the same manner as traditional computer viruses. Unlike the PC-based versions, mobile malware is incapable of spreading on its own. It cannot infect a network and then copy itself to other devices. Mobile devices require people to actively allow things to be downloaded and installed, limiting the spread of malware.
This doesn’t mean malware cannot spread across devices, it just means that the process requires engineering a situation where the human user makes a terrible mistake.
Creating the opening is not entirely difficult. Apps containing malware can be found all over the place, often disguising themselves as legitimate apps to fool users. This is particularly effective for apps that are not free; as some mobile users will try to pirate or sideload them.
Security firm F-Secure discovered that 97% of all mobile malware was found on Android devices. However, this number is extremely misleading. While a huge number of malware was discovered on Android, less than 0.1% of it originated from Google’s Play Store – which indicates weaknesses in third-party app stores.
As for other platforms: iOS, BlackBerry and Windows Phone combined have less malware than Symbian.
Going without an antivirus is certainly an option. Most smartphone users manage to get along without one. After all, the best security measures are those where the user is careful with what happens while connected. Simply paying attention to the permissions required by apps can go a long way to ensuring malware does not find its way in.
Traditionally, malware is designed to gather information about the user. Personal information, credit card numbers, and contacts are all valuable to criminals. However, there are other ways obtaining all that without having to deploy any sort of malicious attack package.
WiFi spoofing is an increasingly common method of stealing data. It works by leaving a WiFi router out to trick passing devices into connecting to it. This is usually possible because people leave their smartphones and tablets to continuously search for an open network. Once connected, the malicious network functions exactly like a normal WiFi network; expect that it records all the information that passes through it. This usually isn’t much, but it can easily steal passwords and other login information.
The amount of personal information people willingly share on the Internet may also mean that using illegal and unethical methods for data collection are unnecessary.
This simply means that most security issues can be solved without the need of mobile anti-virus. However, that is not to say that this sort of software is a waste of money. Mobile anti-virus is still helpful for screening potentially damaging malware hidden in attachments like PDF files and pictures, both of which are less common attack vectors, but also easier to work around the security of the app stores. Before iPad and iPhone users get smug, this type of malware is very capable of operating on Apple products. Only Windows Phone poses a difficulty for malware, but that is because it infuriatingly refuses to run anything in the background.
It is in situations like this that an anti-virus becomes the only layer of security you will have. Suspicious attachments are not always easy to avoid, and those of us who deal with many emails in a day will tend to open attachments as a reflex. It is not much of an issue if your mobile device is for personal use; at most, your email password gets stolen (and you should be using two-stage authentication anyway).
Mobile devices used for work present the greater concern. There is more at stake here, and the extra security might actually matter. Especially as threats become more sophisticated and malware becomes more efficient at hijacking devices, like these ones that hijack smartphone processing power to mine Bitcoin.
Therefore we return to the question of, does one need mobile anti-virus? I can say that regular use should not bring the average user into contact with malware very often; and taking proper precautions are more than enough to keep a person free from infection. On the other hand, implementing extra security measures with an antivirus program will provide that extra layer of protection in the event of a particularly tenacious attacker. So, there really is no harm in getting an anti-virus program.
