Google Play Protect bolsters Android security with real-time app scanning

In a bid to bolster the security of Android users, Google has introduced a new feature within its in-built security engine, Google Play Protect. This feature conducts real-time code-level analysis of Android apps and prevents potentially harmful apps from being installed on devices.

The move comes as a response to the rising threats posed by malicious apps, especially those sideloaded from sources outside the official Google Play Store.

Real-time app scanning to the rescue

Google unveiled this new real-time app scanning feature in October, which focuses on identifying and blocking malicious or fake apps that are sideloaded from unverified sources. These rogue apps often employ various tactics to evade detection, such as morphing their appearance or using AI to alter their code.

The real-time app scan begins by analysing the app's code, extracting critical signals, and transmitting them to the Play Protect backend for a code-level evaluation. Google Play Protect now recommends this scan for any new app that has not been previously analysed. 

Countering predatory loan apps

One of the primary motivations behind this enhanced security feature is to combat the proliferation of predatory loan apps, which have been linked to the harassment and exploitation of users. These apps gain unauthorised access to user data, including contacts and photos, and are responsible for various privacy breaches.

While Google has taken steps to remove thousands of such apps that violate its policies, attackers keep finding new ways to target victims. Google initially launched this Play Protect update in India, with plans to expand it globally.

Real-world testing & efficacy

To gauge the effectiveness of Google Play Protect, multiple tests were conducted using the updated Google Play Store with real-time code-level scanning. These tests covered various categories of malicious apps, including spyware, stalkerware, and predatory loan apps. This evaluation aligns with findings from several user tests.

The results were largely promising, with Play Protect successfully blocking most of these apps, and providing warnings about potential threats. However, a few predatory loan apps managed to bypass the security measures, emphasising the evolving challenges of maintaining app security.

In short, Google's real-time code-level scanning feature within Play Protect serves as a critical last line of defence for Android users, especially those who sideload apps. As the Android ecosystem continues to face new threats, these capabilities are expected to evolve and improve over time, ensuring a safer mobile experience for billions of users.