Download Mobile Security Report 2014 - AV

Product Review: Mobile Security ‐ July/August 2014
www.av-comparatives.org
Introduction
Smartphones represent the future of modern communications. In 2013, more than 1 billion
smartphones were sold, a further milestone in the advance of these devices1. A study published by
Facebook emphasises the importance of smartphones in our lives; about 80% of users make use of
their smartphone within 15 minutes of waking up each day2.
At the same time, the traditional function of a telephone is becoming less and less important. The
high quality of integrated cameras means that the smartphone is increasingly used for photography.
As well as with photos, users trust their devices with their most personal communications, such as
Facebook, WhatsApp and email. This brings some risks with it, as such usage makes the smartphone
interesting for criminals, who attempt to infect the device with malware or steal personal data.
There is also the danger brought by phishing attacks.
These days, the use of security software on a PC or laptop is seen as essential. However, many
smartphone users do not yet have the same sense of responsibility, even though their devices store
personal data, private photos, Internet banking information or even company data.
As modern smartphones are often expensive to buy, they are also an attractive target for thieves.
Top-quality smartphones cost several hundred Euros. As it is not possible to physically prevent them
from being stolen, they must be made less attractive to thieves. Consequently, many of today's
security products contain not only malware protection, but also highly developed theft-protection
functions, which make the device less attractive to thieves (e.g. by locking the device), and help
the owner to find it again.
This year, we have once again tested security products for smartphones running Google's Android
operating system. Our report covers details of the products made by leading manufacturers who have
agreed to participate in our review. The test was conducted in July and August 2014 on an LG Nexus
5 smartphone running Android 4.4.2. In the event that a function did not work properly, we then
installed the product on a Samsung Galaxy S3 Mini with Android 4.1.2 and repeated the test. This
verifies whether the malfunction is a general one, or is limited to the newer Android version. We
also tested the "wipe" function (deletion of personal data) of each applicable product on the
alternative device, with particular regard to the deletion of data on the external SD card. This was
necessary, as the Nexus 5 does not allow an external SD card to be used.
In general, we found that the current Android version, 4.4, clearly has problems with text-message
blocking features in security products. None of the products we tested was able to make this work.
Many manufacturers warn the user of this. Text messages cannot be blocked or hidden under
Android 4.4. This is particularly problematic for products that use text-message commands to
control their features. Thieves are able to see text messages in plain text, meaning that they can
see the password. We thus recommend sending a "lock" command first, before using other features
such as locating or wiping the device. This is the only way the user can ensure that a thief does not
have access to his or her texts.
Security software for Android usually requires a wide range of operating-system permissions, which
we granted, to ensure that the program would work properly. We noticed a high degree of variation
between products, however. We decided to publish a table in this year's report that displays all the
permissions required by each product. This can be seen in the appendix on page 87.
1
http://www.dw.de/2013-%C3%BCber-eine-milliarde-smartphones-verkauft/a-17391228 (German)
2
https://fb-public.app.box.com/s/3iq5x6uwnqtq7ki4q8wk
-3-