Risk Expert: Anti-Malware Apps Have Little Value On Android

While stopping short of calling AV vendors "scammers and charlatans," descriptions used by Chris DiBona, open-source programs manager at Google, Jody Brazil, chief technology officer at FireMon, said anti-malware software is not needed on phones using Google's operating system, as well as on smartphones from Apple and Research In Motion, makers of the BlackBerry.

"I have not seen significant value in the anti-malware concept for cellphones," Brazil said in an interview Wednesday.

Brazil agreed with DiBona that the use of a security mechanism called a sandbox in Android and the other phones greatly reduced the risk posed by malware. A sandbox is a container used to run each application, thereby tightly controlling the resources open to the software. The mechanism makes it difficult for malware to access data it is not authorized to use.

"The sandbox nature of the phone makes spreading malware a much smaller problem," Brazil said.

Overland Park, Kan.-based FireMon sells software that helps organizations locate areas in IT systems most vulnerable to a malware attack. Such evaluations help in determining where a business should direct its security dollars.

DiBona's verbal offensive against anti-malware vendors came last week in response to a steady drumbeat of Android security risks. While DiBona did not name any vendors, Symantec, Kaspersky Lab and McAfee, Intel's security unit, have released reports showing the amount of malware targeting Android is rising dramatically, an indication that cybercriminals are going after what they see as low hanging fruit.

"Virus companies are playing on your fears to try to sell you BS protection software for Android, RIM and iOS," DiBona said in a post on the Google+ social network. "They are charlatans and scammers. If you work for a company selling virus protection for Android, RIM or iOS, you should be ashamed of yourself."

Anti-malware vendors argue that Android is particularly vulnerable to attack for several reasons. Cyber-criminals have an easier onramp to the device because applications offered through Google's Android Market do not undergo the same rigorous review as apps published on Apple's App Store. In addition, any web site, not just the Android Market, can offer apps for download.

Other factors include the size of the target -- Android phones account for more than half the smartphone market -- and the glacial pace at which manufacturers release updates.

On Wednesday, McAfee and Kaspersky Lab stood by their research pointing to the need for anti-malware on Android phones. "While Android anti-malware products are still not a necessity like they are on PCs, users should strongly consider using them if they’re concerned about the information they store on their devices and the security transactions they perform with it," Kaspersky said in an e-mail.

McAfee argued that smartphones and tablets are no different than PCs when it comes to security. "The fact is that smartphones and tablets are computers, and they store valuable information, just as computers do," the vendor said. "Criminals recognize this, and have found new ways to extract information from those devices."