Path: ...!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Arno Welzel <usenet@arnowelzel.de>
Newsgroups: comp.mobile.android
Subject: Re: Does Android scan every app you install or only apps installed
 from the Google Play Store?
Date: Mon, 3 Jun 2024 17:36:38 +0200
Lines: 35
Message-ID: <lc6685Fg23U1@mid.individual.net>
References: <v3inaj$2cj3i$1@news.samoylyk.net>
 <lc5q7iFt7dnU1@mid.individual.net> <dbt0jkx1a7.ln2@Telcontar.valinor>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Trace: individual.net 9e3BDa1gGvlgEDkekhVMmgvM9I5F19t6IrkrEjJSfTXykPLDsM
Cancel-Lock: sha1:NWqPh3sSz7nCswcfAUDwQayRUTs= sha256:K7uVYd44pyAR5f1f9lNsmoh8/KBU2AEWsyXlv1ZQxJk=
Content-Language: de-DE
In-Reply-To: <dbt0jkx1a7.ln2@Telcontar.valinor>
Bytes: 2432

Carlos E.R., 2024-06-03 15:34:

> On 2024-06-03 14:11, Arno Welzel wrote:
[...]
>> Also see: Settings -> Security & privacy -> App security -> Play protect
>> and the the "Play Protect settings" you can open with the settings icon
>> on the top right. In these settings there is also the following option,
>> which is enabled by default:
>>
>> Improve harmful app detection
>> Send unknown apps to Google for better detection
>>
>> And "unknown apps" means apps which you did not install using Google
>> Play but by using an APK file or alternative sources like F-Droid.
> 
> I assume that applications on the google play server are scanned "by the 
> server", in advance, and other applications are scanned later, dunno if 
> locally or after they are uploaded for scan at the server. Oh, rather 
> the later: it says "Send unknown apps to Google for better detection"

I assume, Google Play services create some kind of signature for every
app and maintain a catalogue of known signatures of malicious apps and
app versions. Whenever a new app from outside of Google Play is
installed, the check will be, if the signature of that app is already
known and if not, it will be send for verification to the Google Play
servers where it will get scanned and the signature along with the scan
result will be stored. So next time the same app package will be
installed by someone else, Google Play already knows the signature and
can warn the user or stop the installation if the app is known to be
malicious.

-- 
Arno Welzel
https://arnowelzel.de