Making it safer to get apps on Android O

Posted by Edward Cunningham. Product Manager, Android Security


Eagle-eyed users of Android O will have noticed the absence of the 'Allow
unknown sources' setting, which has existed since the earliest days of Android
to facilitate the installation of apps from outside of Google Play and other
preloaded stores. In this post we'll talk about the new Install unknown
apps permission and the security benefits it brings for both Android
users and developers.



Earlier this year we introduced href="https://www.blog.google/products/android/google-play-protect/">Google Play
Protect - comprehensive security services that are always at work to protect
your device from harm. Google Play continues to be one of the safest places for
Android users to download their apps, with the majority of Potentially Harmful
Apps (PHAs) originating from third-party sources.



A common strategy employed by PHA authors is to deliver their apps via a hostile
downloader. For example, a gaming app might not contain malicious code but
instead might notify the user to install a PHA that masquerades as an important
security update. (You can read more about hostile downloaders in the href="https://www.blog.google/topics/connected-workspaces/diverse-protections-diverse-ecosystem-android-security-2016-year-review/">Android
Security 2016 Year in Review). Users who have enabled the installation of
apps from unknown sources leave themselves vulnerable to this deceptive
behavior.








Left (pre-Android O): The install screen for a PHA masquerading as a system
update.
Right (Android O): Before the PHA is installed, the user must first grant
permission to the app that triggered the install.



In Android O, the Install unknown apps permission makes it
safer to install apps from unknown sources. This permission is tied to the app
that prompts the install— just like other runtime permissions—and ensures that
the user grants permission to use the install source before it can prompt the
user to install an app. When used on a device running Android O and higher,
hostile downloaders cannot trick the user into installing an app without having
first been given the go-ahead.



This new permission provides users with transparency, control, and a streamlined
process to enable installs from trusted sources. The Settings app shows the list
of apps that the user has approved for installing unknown apps. Users can
revoke the permission for a particular app at any time.








At any time, users can review the apps that they've allowed for installing
unknown apps. To make the permission-granting process easier, app developers can
choose to direct users to their permission screen as part of the setup
flow.


Developer changes




To take advantage of this new behavior, developers of apps that require the
ability to download and install other apps via the Package Installer may need to
make some changes. If an app uses a targetSdkLevel of 26 or above
and prompts the user to install other apps, the manifest file needs to include
the href="https://developer.android.com/reference/android/Manifest.permission.html#REQUEST_INSTALL_PACKAGES">REQUEST_INSTALL_PACKAGES
permission:



class="prettyprint"><uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />


Apps that haven't declared this permission cannot install other apps, a handy
security protection for apps that have no intention of doing so. You can choose
to pre-emptively direct your users to the Install unknown apps
permission screen using the href="https://developer.android.com/reference/android/provider/Settings.html#ACTION_MANAGE_UNKNOWN_APP_SOURCES">ACTION_MANAGE_UNKNOWN_APP_SOURCES
Intent action. You can also query the state of this permission using the
PackageManager href="https://developer.android.com/reference/android/content/pm/PackageManager.html#canRequestPackageInstalls()">canRequestPackageInstalls()
API.


Remember that href="https://play.google.com/about/developer-content-policy/">Play policies
still apply to apps distributed on Google Play if those apps can install and
update other apps. In the majority of cases, such behavior is inappropriate; you
should instead provide a href="https://developer.android.com/distribute/marketing-tools/linking-to-google-play.html">deep
link to the app's listing on the Play Store.



Be sure to check out the updated href="https://developer.android.com/studio/publish/index.html#publishing-unknown">publishing
guide that provides more information about installing unknown apps, and stay
tuned for more posts on security hardening in Android O.




Komentar

Posting Komentar

Postingan populer dari blog ini

Google Play Referrer API: Track and measure your app installs easily and securely

Gambar
it is crucial to helping you make the right product and marketing decisions. This is especially important when you're deciding your advertising strategy and budget. "> Posted by Neto Marin, Developer Advocate Understanding how people find your app and what they do once they've installed it is crucial to helping you make the right product and marketing decisions. This is especially important when you're deciding your advertising strategy and budget. Today many app measurement companies and ad networks offer ad attribution solutions based on referral data. As such accurate install referral data is vital for correctly attributing app installs, as well as discounting fraudulent attempts for install credit. To help you obtain more accurate and reliable data about your installs, we're introducing the Google Play Install Referrer API , a reliable way to securely retrieve install referral content. Using this API, your app will get precise information straight from the P...
Baca selengkapnya

Boosting developer success on Google Play

Gambar
Posted by Sameer Samat, VP, Product Management Helping developers build sustainable businesses is a core part of Google Play’s mission. We work with partners every day to understand the challenges they face and help them bring their innovative ideas to life. Getting a new app off the ground and into orbit is not easy! To aid their quest for growth we provide a broad range of support, from powerful marketing tools and actionable data in the Play Console , education via Play Academy , "> best practices and thought leadership resources, programs such as the Indie Games Festival , Indie Corner , and accelerator programs around the world. We’re always looking for new ways to give them an added boost. Starting on July 1, 2021 we are reducing the service fee Google Play receives when a developer sells digital goods or services to 15% for the first $1M (USD) of revenue every developer earns each year. With this change, 99% of developers globally that sell digital goods and servic...
Baca selengkapnya

And the 2019 Google Play Award nominees are...

Gambar
Posted by Purnima Kochikar, Director, Apps and Games Business Development, Google Play Drum roll please! To kick off Google I/O this year, the 2019 Google Play Awards will take place on Monday, May 6th. We’re excited to highlight nine categories this year, some familiar and some new, to recognize developers that continue to set the bar for quality apps and games on Google Play. Building on previous years, we celebrate our fourth year by recognizing some of the best experiences available on Android, with an emphasis on overall quality, strong design, technical performance, and innovation. The nominees were selected by various teams across Google, and meet criteria thresholds covering high star rating, Android vitals, and have had a launch or major update since April 2018. Congratulations to this year’s nominees below and remember to check them out on Google Play at play.google.com/gpa2019 . Stay tuned as we announce the winners of each category at Google I/O. Standout Well-Being App App...
Baca selengkapnya