Did Google Make the Right Move to Protect the Android Market?

Just last week, Wired’s Gadget Lab wrote about Google’s Android security improvements, and how they plan to make the platform more secure for users. As noted in the post, the draw for the Android platform lies in its openness, but at the same time, this presents a number of security challenges for the operating system.

So how does Google plan to make Android more secure? The company unveiled a new security service for Android that aims to auto-scan uploaded Android applications to detect potentially malicious apps more quickly – ideally before users download them. The service searches for threats without requiring any pre-approval process so that the platform can remain as “open” as always.

Some of my initial thoughts about this announcement are skeptical in all honesty. In “controlling” the security of the platform, Google is taking the stance that they know more about mobile security than anyone else, including the security professionals who’ve been detecting threats, and stopping attacks for 30+ years.

By creating the “sandbox security” model within Android, Google has in fact raised the bar for WHO can create malware for Android, and what the potential is for that malware, but in doing this, they’ve completely locked out the good guys. Consider the case where either Android or iOS have a security hole (all the methods for jail-breaking fit in this category). Bad actors can run at full speed until Android or iOS block the hole. Meanwhile, security pros are locked out from doing anything on the device that would detect this.

Ultimately it is clear that both Google and Apple had the foresight to recognize that AV and other signature detection is dead, but they closed the door on allowing newer, more innovative solutions. This is a problem for many security professionals unless you’re under the assumption that the client is untrustworthy no matter the platform. Only the server-side can be trusted when it comes to detecting threats, and that is the mentality and direction that the market needs to go in order to effectively “secure” mobile (and all other types of) platforms.