Archives

Managing Your Virtual Identity & Protecting Your Personal Information

By James Green ~ September 26th, 2013 11:18 PM MST

In a webinar hosted by CSID, Washington University professor of law said “You take time for your physical appearance, you should do the same for your online appearance.” Mr. Richards hit the nail on the head with that statement. It is important to know the risks involved with social media and how to avoid over-sharing.

Google-ing yourself is no longer a past time for celebrities. Everyone should be Google-ing themselves, Yahoo-ing themselves, and Bing-ing themselves. It is important to review your virtual identity and know what kind of personal information is publicly available. The modern world is interwoven with the virtual world; there is not an online world and an offline world, there is just life.

PROTECTING YOUR PERSONAL INFORMATION

Personal security is a major concern due to over sharing online, particularly on social media. A recent study conducted by PewInternet.org found that 72% of internet users use social media; that number increases to 89% for individuals under the age of 30. Cyber criminals can easily scan social media profiles for information that can be used to steal identities. Social media profiles contain answers to many common security questions such as your mother’s maiden name, your dog’s name, the city where you were born, your spouse’s birthday, etc. This seemingly harmless information shared on social media can be used to your detriment. According to CyberSafeID 54% of social media users have been targeted by identity thieves.

Securing online information is essential to protecting both your online and offline identity. Websites such as Spokeo.com or PeopleFinders.com allow you to search for yourself (or others) by name, email, phone number, etc to see what personal information is publicly available. If necessary, you can contact these websites to have information censored. In addition to finding out what information is publicly available you should also take the following steps to secure your information in the future.

  • Adjust social media privacy settings. Many websites privacy settings default to “Public.” It is better to change privacy settings to “Friends Only” or “Custom.”
  • No matter what the privacy settings are consider all information posted online to be public. Never post anything that you wouldn’t be willing to repeat in a professional situation.
  • Avoid posting your location on social media. Doing so allows others to track your movement and advertises to thieves that your home may be unattended.
  • Avoid sharing personal information such as your birthday, birth place, phone number, or email address. Also avoid sharing this information about others.
  • Avoid using applications or games that request access to your social media login credentials.
  • Don’t accept friend requests from strangers. There is no way to confirm a stranger is not attempting to harvest your personal information.
  • Always log off of social media accounts after you are finished with your session.

MANAGING YOUR PERSONAL & PROFESSIONAL ONLINE IDENTITY

Online interactions undoubtedly have an impact in real life. There are numerous accounts of people being fired for posting inappropriate or derogatory information online. There are even websites that are dedicated to tracking people who complain about their jobs online. Be smart with your online identity; don’t put your personal or professional relationships at risk.

In a recent study performed by Jobvite it was found that 93% of recruiters will review a candidate’s social media profile. The contents of your social media profile will directly impact your chances of being hired for the position.

Survey1

Of the recruiters surveyed, 42% said that they have reconsidered hiring a candidate based on what was found on the candidate’s social media profiles. All job-seekers should expect to have their social media accounts vetted. This applies to business contacts as well, the study by Jobvite also stated that “42% of people have scoped someone out on the Internet before doing business with them – and 45% of those have changed their minds about doing business based on something they discovered on the Internet.”

Take steps to find out what personal information is publicly available and manage your online identify. A good rule when developing an online identify is to promote yourself as if you are a business.

  • Google yourself, if you have a common name (ex. John Smith) include your location to narrow the search.
  • View the public version of your social media profiles to better understand what information is publicly displayed.
  • Make an effort to remove any “bad press” about yourself.
  • Register for Google Alerts to be notified if information about you is posted online.
  • Purchase your domain and create a personal website with a small bio.
  • If necessary, create professional versions of your social media accounts.
  • Connect with experts and other professionals in your field using social media.
  • Never post anything that you wouldn’t be willing to repeat in a professional situation (repeated, but especially important).

MANAGING YOUR ONLINE BUSINESS IDENTITY

Approximately 85% of consumers research products and services online before making a purchase. Managing your businesses identity, including consumer reviews, is vital to maintaining a positive online image. Websites like Yelp.com and AngiesList.com are used by consumers to post reviews of local businesses. Business owners should set up a business profile on these websites (and others like them) so that they can monitor customer feedback and address customer complaints. Businesses should also create social media profiles; if used correctly it can be an excellent marketing tool.

Using social media can be a fun way for companies to interact with their customers. This kind of interaction can be both entertaining and promote a good brand image. A well placed tweet can lead to major exposure; in the following example three tweets between Old Spice and Taco Bell resulted in 1000+ re-tweets. These re-tweets likely reached tens of thousands of consumers.

tacobell

Just as social media can be a great tool for businesses, it can also be a hindrance if used improperly. A particularly volatile misuse of social media was exhibited following an episode of Gordon Ramsey’s Kitchen Nightmares. Following an episode the public was openly critical of the restaurant owners via Facebook. Unfortunately, the owners did not respond well to the public criticism and verbally abused their critics. The social media disaster that ensued lead to an incredible amount of bad press and is well documented. This is a social media horror story and a cautionary tale.

Nightmare

Larger corporations are not immune to social media mishaps. Recently AT&T received a large amount of criticism for a Twitter post that many considered to be an exploitation of a national tragedy.

ATTNeverForget

The public outrage about AT&T’s September 11th tweet was centered around the idea of using a national tragedy in an advertising campaign. Many accused AT&T of exploiting the tragic death of thousands for financial profit. AT&T quickly deleted the tweet in response to the overwhelming criticism and issued an apology.

ATTApologize

Businesses should not avoid online activity; 90% of consumers say they are less likely to buy from a company that does not respond to posts, comments, or reviews. Instead, businesses should take an active role in managing their online image. A positive online reputation can lead to real world sales. Protect and promote your business’ online image by implementing the following tips.

  • Purchase a relevant domain name and build a professional website.
  • Establish a business page on popular customer review websites such as Yelp and AngiesList.
  • Address consumers’ complaints found online and attempt to resolve them quickly.
  • Establish social media accounts to promote your business and interact with customers.
  • Register for Google Alerts to receive notifications when your business is mentioned online.
  • Never post anything that you wouldn’t be willing to repeat in a professional situation (repeated x 3, cannot stress the importance enough).
  • Compare your online reputation to your competitors and attempt to surpass their reputation. ♦

James Green is a mobile security researcher who has worked in the Android security field for several years providing privacy and security advice to Android users. Email: James@ArmorforAndroid.com; Twitter: @James_AfA

Google Two-Step Verification: Double Protecting Your Account

By James Green ~ September 14th, 2013 11:21 PM MST

When it comes to online security there is no such thing as “too much protection.” This is especially true with regard to Google accounts. Google accounts have access to much more than emails; Google Wallet has access to credit card information, and Google Drive has access to personal and professional documents. If only it were possible to protect all of this sensitive information with more than a password…

Enter Two-Step Verification. Google now offers a form of authentication similar to what has been used in the banking industry for several years. The first step in two-step verification is still the use of a password. The second step of the two-step verification is designed to verify the identity of anyone attempting to log in to you Google Account; this is done by sending a unique, six digit security code to the account owners phone number. This ensures that anyone attempting to access your Google account must have physical access to your phone or be able to contact you for the security code (and thus receive your permission to access the account). Two-step verification is a great way to prevent hackers from gaining remote access to your Google account and the sensitive information contained therein.

It takes less than 10 minutes to enable two-step verification. The setup process for two-step verification can be completed via a computer or with a mobile device. For your convenience we have created a step by step tutorial for each process.

Click here for Setting up Google Two-Step Verification (Computer Tutorial)

Click here for Setting up Google Two-Step Verification (Mobile Device Tutorial)

Certain applications on smartphones require access to your Google account such as email clients (Outlook) or chat clients (Google Talk). These applications will require a special password to be created in the two-step verification dashboard. Setting up these passwords is easy and we have created a guide for this process as well.

Click here for the Setting up Application Specific Passwords

Setting Up Google Two-Step Verification (Computer Tutorial)

1.) Log in to your Google Account. Once you have logged in to your account select the drop down menu in the top right corner of the Google.com home page. From the drop down menu click the  “Account” button and you will be directed your Google account settings page.

CompStep1a

2.) Select “Security” from the menu that runs down the left side of the Account settings page. This will direct you to the page where you can edit your two-step verification settings. CompStep2

3.) The fourth option on the security page is “2-Step Verification”. In this section you should see that the “Status” is currently “OFF.” To begin the set-up process and enable Two-step verification select “Edit” link. CompStep3

4.) You should now see the following content on your screen. Select the “Start Setup” button.

CompStep4 5.) Because this is a security change to your account you will be asked to confirm you identity by entering your login information again. You will not be asked for you password again during process.

CompStep5 6.) Once you have re-entered your login credentials you will be present with a screen requesting a phone number. The phone number you enter will be the phone number that receives the six digit security code, be sure to choose a phone number you will consistently have access to such as a mobile phone. On this screen you will also select to receive the security code via text message, or voice call.

CompStep6a

7.) The phone will immediately receive either a text message or a voice call (depending on your selection) with your six digit security code. Enter the six digit security code in to the text box on this screen and select the blue “Verify” button.

CompStep7a

8.) There is an option to “Trust this Computer” which will remember the computer in the future so you are not required to enter a new security code every time you log in to your account. Please only select “Trust this Computer” if it is a personal or business computer, do not trust a public or shared computer.

CompStep8a

9.) Finally, select “Confirm” to enable two-step verification for your Google account!

CompStep9

If you use applications on your mobile device that require the ability to log in to your Google Account you will need to set up “Application Specific Passwords.” Click here to skip ahead to our Setting up Application Specific Passwords tutorial.

Setting up Google Two-Step Verification (Mobile Device Tutorial)

1.) Open the device browser and navigate to Google.com and scroll down to the bottom of the page. The footer contains a link that reads “Privacy & Terms,” click on this link.

mobileStep1

2.) From the Privacy & Terms page scroll down until you see the heading “2-Step Verification.”  In the section under this heading click the link that reads ”Find out how to set up 2-step verification.”

mobileStep2

3.) On the 2-step verification page click the blue button that read “Get Started.”

mobileStep3

4.) Now you will be required enter your login username and password to log in to your Google account.

mobileStep4

5.) Click the blue button on the right side of the screen that reads “Start Setup.”

mobileStep5

6.) You can download the Google Authenticator application or you can skip this step and receive the security code via Text message or Voice Call. In our experience we found the Text messaging and Voice Call options to be easier.

mobileStep6

7.) On this screen you will be required to enter the phone number you wish to receive the security codes to. Choose a phone number that can be accessed at any time, such as a mobile phone number. You can also select whether or not you wish to receive the security code via text message or voice call. Once you have entered your phone number and made your selection click the blue button the reads “Send Code.”

mobileStep7

8.) You will immediately receive your first security code via your chosen method (text message or voice call). Retrieve the security code and enter the code into the text box on this page. Click the blue “Verify” button to continue.

mobileStep8mobileStep8a

 

9.)  There is an option to “Trust this Computer” which will remember the computer in the future so you are not required to enter a new security code every time you log in to your account. Please only select “Trust this Computer” if it is a personal or business computer/mobile device, do not trust a public or shared computer/mobile device.

mobileStep9

10.) The final step to enable two-step verification for your Google account is to click the blue “Confirm” button.

mobileStep10

Setting up Application Specific Passwords

Applications that require access to your Google account such as email clients (outlook) or chat clients (Google Talk) will require a new password to be created. The password will need to be generated in the Two-Step verification dashboard and will be unique for each application. If you ever lose a password the Two-Step verification dashboard keeps track of the passwords for you.

1.)    Log in to your Google account and click “Account” from the drop down menu.

Password1

2.)    Select “Security” from the menu on the left side of the page.

Password2a

3.)    Scroll down the “2-Step verification” section and select the “Manage your application specific passwords” link.

Password3

4.)    Enter a reference name that will help you remember which application the password is associated with. Then click the “Generate Password” button.

Password4

5.)    A password will be generated for you, take this password and enter it into the log in settings of the appropriate application on your mobile device. The two-step verification dashboard will save your password history should you lose the password for any reason.

Password5

James Green is a mobile security researcher who has worked in the Android security field for several years providing privacy and security advice to Android users. Email: James@ArmorforAndroid.com; Twitter: @James_AfA

Protecting Your Private Information with a Screen Lock

By James Green ~ April 20th, 2013 12:34 AM MST

Using a form of screen lock is the first line of defense for your sensitive information in the event of a lost or stolen device. In 2012 mobile security company Symantec preformed an experiment called the “Smartphone Honey Stick Project” where 50 smart phones were purposely lost in high traffic public areas. The devices were preinstalled with special applications that sent device usage information and GPS location back to the researchers. The results of this experiment were that of the individuals who found the devices only half made an attempt to contact the owner to return the device, but a startling 96% of the lost devices had their information accessed. Over 80% of the devices had personal or corporate information accessed and more than 70% of the devices had the photos accessed. Whether or not the individuals who found the devices made an attempt to return the device it seems that almost universally the private, sensitive information stored on the device was viewed by strangers.

SLoptions screenlock settings

Symantec purposefully did not use the screen lock features in their experiment to highlight the necessity of using the screen lock feature that is available on all Android devices. The screen lock feature prevents unauthorized access to the potentially sensitive information such as emails, photos, passwords, text messages, etc if the device is ever lost or stolen. The screen lock features are incredibly easy to set up and there a few different kinds of screen lock that can provide a varying level of security.

To set up the screen lock feature on your device go to the main device ‘Settings’. From the settings menu select ‘Security’ (the exact title of this section may vary between manufactures and models it may be ‘Location and Security’ or ‘Privacy’ and it may require you to do a little searching around). Once you have found and selected the correct ‘Security’ section from the settings menu locate and select ‘Screen Lock’. Now that you have found the screen lock section you will notice that you will have a few different options. Let’s discuss each of these options and the level of security that they provide.

None or Slide Style

This section will be pretty brief as we don’t really have too much to say about these options beyond you should not use them. If you select the ‘None’ option there will be no screen lock feature activated. As we see from the Honey Stick experiment this leaves all of your sensitive information open to unauthorized access. No thank you. As for ‘Slide’ it may as well be ‘None’. A sliding screen lock is not a pattern style screen lock (which we will discuss below) and requires no special password to unlock the device. Anyone can gain access to a device that is “protected” by a sliding screen lock, we’re fairly confident some well trained animals may be able to as well. If you’re looking to protect your device from unauthorized access neither of these options are your solution.

Pattern Style

Now we come to an option that actually offers some level of protection for the device. A ‘Pattern’ style screen lock will prompt the users to create a pattern that will be required to access the device. The pattern is created on a three by three square of dots where the pattern itself is the order in which you connect the dots. To set up the pattern style password select it from the list in the screen lock section. Connect the some or all of the dots in any order that you like and select ‘OK’. You will then be asked to confirm the password by reentering it a second time. Once you have select ‘OK’ a second time the pattern will be set as your screen lock password. You can also select cancel at any time to start over.

Keep in mind basic patterns such as a square or and ‘X’ can be easily guessed so try to have a unique pattern design. A more complex pattern means a greater level of protection for the device. Also remember that your fingers leave grease on the device screen that can be a problem with patterns style lock screens. If finger grease is left on the screen in the pattern of your lock screen pattern password you can be sure that someone trying to access your device will make the connection and be able to crack your password. To prevent this make sure that you wipe your screen clean after you use the device each time.

Pattern Style screen locks are a good form of screen lock protection and they can be great depending on the complexity of the pattern. However, some vigilance is required to ensure that the password isn’t given away by finger grease on the screen. In our opinion this is not the best form of screen lock available but, without question, pattern style screen locks are better than a slide lock or no lock at all.

Face Unlock

Facelock

‘Face Unlock’ is a very interesting screen lock feature, but it may not be available on all devices. We will discuss this for those of you who do have this screen lock feature; those of you who do not have this feature available can skip ahead to the next section. The face unlock option uses facial recognition software to recognize the users with the device camera. During set up the device will take an image of your face that will be used to recognize you each time you unlock the device. After set up the lock screen will display the camera screen that is looking back in the direction of the user, once it recognizes your face it will quickly unlock. This is a really neat feature; however, it’s not without its flaws. The software isn’t exactly government grade and may unlock your device to anyone who resembles you. Also, depending on lighting and the camera angle, the face lock feature may not recognize you either. The face unlock feature allows you to ‘Improve face lock’ by taking multiple photos in different lighting, with or without glasses, clean or unshaven, etc to increase the likely hood of a successful facial recognition. But at this point your really going well out of your way for a screen lock feature that is a little gimmicky and not very secure.

As fun and interesting as this feature may be, face lock isn’t all that reliable. It’s better than nothing, but is not the ideal level of lock screen protection. Regardless of how well it works for you, face unlock will also require you to set up an alternative screen lock option in case it does not work correctly. One of the options that you are presented with during this set up is the PIN screen lock which is one of the two best screen lock features. If you have to set up a PIN screen lock anyway we recommend skipping the hassle of a face unlock and using this feature instead.

PIN Style

Now we are talking protection! This style of screen lock requires the user to create a numeric PIN (Personal Identification Number) between 4 and 16 digits in length. If you select this style of screen lock you will be asked to create your PIN. Once you select ‘OK’ you will be asked to confirm the PIN number by reentering it again. Just like with the pattern style screen lock the cancel button is available at any time to start over. Once you confirm the PIN number and select ‘OK’ for a second time the PIN number will be your screen lock password. The PIN will be required every time you wish to unlock the device.

PIN numbers are used for banks and are obviously a very secure form of lock screen protection… right? Well, there are 10,000 different combinations of four digit PIN numbers the can be created using the numbers 0-9. Of those 10,000 different combinations 426 of them account for approximately half of all PIN numbers used by the public. One more time, 426 different combinations make up about half of all four digit PIN numbers. Just over four percent of the 10,000 possible combinations make up HALF of the PIN numbers used across the world. The fantastic article that statistic comes from also outlines other commonalities of peoples’ PIN numbers and is a far more interesting read than you would anticipate. We recommend that you read the article before you select your own PIN. PIN numbers can be a very secure form of protection but it’s up to each individual to select a strong PIN number. The longer the length of the PIN number the more complex it can be; more complex PIN numbers are stronger, more difficult to crack and provide a higher level of protection. When you do select a PIN for your device, please choose one that is unique.

Password Style Screen Lock

Password protecting your device is definitely the safest form of screen lock protection. This should be the standard for device screen locks, it rarely is but it should be. To set up this feature select ‘Password’ from the screen lock list and enter your password. Once you select ‘OK’ your will be asked to confirm the password, and once confirmed the password will be required each time anyone wishes to unlock the device.

As with PIN numbers, passwords are entirely up to the user to determine how strong they will be. The very first point we want to make about your device screen lock password is don’t use the same password you use everywhere else. If by some chance someone can crack the password for your screen lock they now have access to all of the information that is stored on the device. And if they figure out that they have your password for everything else, they now have access to your entire digital life; consider your identity stolen. To create a strong password make sure that it is no shorter than eight characters. Don’t use real words or complete words in your password, even combinations of real words can be cracked by dictionary cracking software. Use special characters like ‘&’ or ‘#’ throughout the password not just at the beginning or the end. For a really strong password use a password generator, these passwords may be difficult to remember but you can use mnemonic device to help you to remember them. Example password: !B4M-0ds, the mnemonic device to help you remember this password could be; ! be 4 men – 0 dames singing. Anything that you can use to remember a very unique password will provide you with strong protection from unauthorized access to the device.

Bottom Line:

Please, for the love of all that is holy, use some form of screen lock on your device to protect your sensitive information. If you lose your device or if it’s stolen you will have peace of mind knowing that you have protected your private, financial, and corporate information from being misused by a stranger. Smart phones can be considered smart because of how powerful and versatile they are but also because of how much they know so much about each of us individually. Don’t let the wonderful tool that you covet and trust be your downfall because you didn’t do enough to protect your device and its contents. A screen lock is such a simple and easy to use form of protection that is truly effective at preventing any unwanted access to your sensitive information. ♦

James Green is a mobile security researcher who has worked in the Android security field for several years providing privacy and security advice to Android users. Email: James@ArmorforAndroid.com; Twitter: @James_AfA

How to Submit a Threat to Armor for Android to be Reviewed

By James Green ~ April 18th, 2013 10:41 PM MST

If you think that you have found a piece of Android malware that has not yet been detected by our antivirus application we encourage you to submit the application to be reviewed by the Armor for Android team. We review thousands of application a day to discover new Android malware and each day there are mountain of applications to review grows taller. When Armor for Android users send applications to our antivirus lab for review it helps us prioritize and discover malicious threats more quickly. There are two ways that Armor for Android users can submit applications to be reviewed by our antivirus team.

The first way that users can submit potential threats to our team to be reviewed is through our website. On ArmorforAndroid.com we have created an email form for our users to submit information about potential threat that they have encountered. The ‘Report Malware’ link is located under the ‘Support’ category at the bottom of ArmorforAndroid.com. We have highlighted the link with a green box in the screen shot below.

WEBINTERFACE

The email form does not currently have the ability to attach a file, so you will not be able directly upload a copy of the malware you have encountered. For this reason we ask that you be as detailed as possible about what the threat is and how it can be found. If the threat was found on a third party android market, which market was it? What is the name of the application? If the threat was automatically downloaded when you visited a website, which website was responsible for the download? Please provide all of the information that you possibly can so that we can locate and review the malware that you have encountered. Please also provide a valid email address so that we can contact you for further information should the need arise.

Armor for Android does not recommend that you purposefully download a potentially malicious application so that you can submit it to our antivirus team. If you are suspicious of an application prior to download and think that we should review it to determine if it is malware, please use our email submission form and give us all of the information that you have available so that we can locate and review the application. However, if you have already downloaded and installed an application on your Android device and believe that you have witnessed malicious activity we encourage you to submit the application to us directly.

Armor for Android users can submit a threat for review directly through the application on their device. This feature allows users to upload a copy of the application in question directly to our antivirus lab so that we can review the potential threat and determine if it is in fact Android malware.

To submit a potential threat from your device open the Armor for Android application and select the ‘Account’ button located in the center of your screen at the very bottom. In the account section you will see many useful options but the one we are interested in for this tutorial is the ‘Submit a Threat’ button which we have highlighted with a green box in the following screenshot. By clicking on the ‘Submit a Threat’ button you will be taken to the potential threat submission form.

AfALandingPage Submitthreat SubmitthreatScreen

 

Once you have navigated to the ‘Submit a Threat’ page it is easy and quick to upload a potential threat for our team to review. First select from the top drop down menu the application that you find suspicious. Next, select the category of malware that you feel the potential threat falls under. If you have questions about what each category means we have a blog article defining the categories of malware designed to help our users better understand the terms we use to define malware. Finally, before you submit the application to be reviewed, write a short description of the malicious activity you observed so that we have a head start looking for the malicious signatures in the source code of the application. You can also include your reason for submitting the application, such as in the instance of riskware where the application may not be malicious itself but you feel that it could easily be used maliciously by others. Submitting the application to our antivirus lab will require an internet connection so make sure that you are connected to Wi-Fi or your mobile network. Once you click the ‘Submit’ button the application will be uploaded and we will begin reviewing your submission. ♦

James Green is a mobile security researcher who has worked in the Android security field for several years providing privacy and security advice to Android users. Email: James@ArmorforAndroid.com; Twitter: @James_AfA

Armor for Android SD Scan

By James Green ~ April 18th, 2013 8:01 PM MST

SDScanAfALandingPage

Along with the Quick Scan and Deep Scan features, Armor for Android provides a SD scanner that allows users to scan all of the files on the SD card of the device. When an application is downloaded from a third party android market or android forum the application is likely downloaded as an .apk package. These packages are downloaded to the SD card of the device where they can then be opened and installed as full applications. Third party android markets have a higher number of malicious applications so it extremely important to scan all applications downloaded as .apk packages before installing them on the device.

To scan all of the files stored on the device SD card open your Armor for Android antivirus application and navigate to the home screen. The SD scanner button is located on the right-hand side of the home screen. Click on the SD Scan button and the scanner will open and automatically begin to scan all of the .apk packages stored on the SD card. The SD Scanner scans the .apk packages looking for malware signatures in the source code. Any .apk package that contains potentially malicious code will be flagged as a potential threat and displayed to the user.

SDScan3SDScan2

If an .apk file is listed as a potentially malicious application you can click directly on the threat in the SD Scanner to learn more. Once a threat has been clicked on a screen will appear that displays a brief description of what the threat is and what malicious activity the threat performs. By clicking on the brief description you can be take to our Armor for Android Protection center where detailed analysis of Android threats are available. Armor for Android provides the ability to remove potential threat from the SD card immediately upon detection. By clicking the ‘Delete File’ button on the pop up screen the .apk package will be quickly removed from the device.

Armor for Android recommends removing any potential threats from the SD card of the device. Threats found on the SD card could in fact be Android malware which could put the device and sensitive information that it contains at risk of being stolen and misused. Malicious activity of Android malware varies but can include monitoring device activity and location, stealing sensitive information or money and can even damage the device itself. Always be cautious when downloading applications in the form of .apk packages form third party android markets as the markets rarely screen these applications to ensure their safety. Any .apk packages that have been downloaded should be scanned using the Armor for Android antivirus application prior to being installed on the device. ♦

James Green is a mobile security researcher who has worked in the Android security field for several years providing privacy and security advice to Android users. Email: James@ArmorforAndroid.com; Twitter: @James_AfA

Armor for Android Security Tab

By James Green ~ April 16th, 2013 12:14 AM MST

At Armor for Android we take your privacy and security very seriously and we aim to make maintaining a secure device quick and easy. The Armor for Android Security tab allows users to review all of the permissions requested by all of the applications on their device. The security tab can be found on the blue menu bar at the bottom of the Armor for Android application.

We have discussed throughout other tutorials and blog articles the importance of permissions granted to an application. Applications permissions can be the most concrete way to determine if an application is malware. Permissions granted to an application that do not have any direct relation to the applications function are often a strong sign that an application may be malware. A couple quick examples of permissions that are not related to an applications function is a calculator application that requests access to send and receive SMS messages; or an alarm clock application requesting permission to make outgoing phone calls or access the device camera, neither of those permissions have any relevance to the function of the application.

SecurityTab2

SecurityTab1

All permissions granted to every application installed on the device will be listed in the security tab section. Armor for Android will prioritize applications to highlight which applications have been granted permissions that could be potential security or privacy risks. All applications will be presented in order from highest risk to lowest risk.

In the security tab there are two columns next to each application, one to indicate a potential security threat and another to indicate a potential privacy threat. An icon is placed in each of the columns to indicate if the permissions granted to the application are either a security or privacy threat or if the granted permissions are trustworthy.  A solid green circle in either the security or privacy columns indicates that the permissions granted to the particular application is not a risk.  A triangular sign with an exclamation mark in either the security of privacy columns indicates that the permissions granted may put the device and the information it contains at risk.

When any application listed in the security tab is selected a screen will appear that provides further information about the permissions granted to each application. Permissions may be divided in up to three categories: Security Warning, Privacy Warning and All permissions.

PrivacyPermissions

SecurityPermissions

If the permissions granted to any application can be considered a potential security risk then the Security Warning category will be the first to appear. Security Warning permissions are anything that malware can use to make changes to the device or to engage in malicious activity. Malicious activity varies but common examples of malicious activity are sending SMS messages to premium rate SMS subscriptions or making phone calls to premium rate numbers.

The Privacy warning is the next section to appear and include all permissions that represent a privacy threat. Malware can use permissions included in the Privacy Warning category to harvest information about the user from the device and forward this information to a remote server. Spyware commonly uses privacy warning permissions to monitor device activity such as collecting information about all incoming and outgoing calls and text messages, emails, internet history, GPS location, and in particularly invasive cases can even turn on the device microphone and actively listen to the immediate surroundings of the device.

The final section lists all permissions granted to each particular application. With all of the permission granted to a particular application the user can draw a better overall picture of an applications function to determine if it likely malware or not. Not all application that have permission to access your GPS location are a threat, however if an application has permission to access GPS location, access network connection and send and receive information, this may indicate that the application is maliciously tracking the device.

At the bottom of the information screen listing the three sections of permissions are two action buttons; ‘Trust’ and ‘Don’t Trust’. Trusting an application will not remove it from the list, remember all applications either trustworthy or suspicious are listed in the security tab. Instead trusting an application will replace the triangular potentially risks signs with a green thumbs up symbol. This is to indicate that this application had been flagged as potentially malicious and has been reviewed by the user and determined trustworthy. Using a different trustworthy symbol allows users to differentiate between apps that started as trustworthy and others that were determined to be so.

You may want to remove an application from your device if it is flagged as a potential security or privacy risk, to do so select the ‘Don’t Trust’ button. This button will prompt you to completely uninstall the application from your device. Once an application has been removed from the device normally it no longer poses any further threat to the device or your information. If you feel that you have been infected by a malicious application please also review our blog articles on the topic to ensure that there is no further action required to eliminate the threat completely. ♦

James Green is a mobile security researcher who has worked in the Android security field for several years providing privacy and security advice to Android users. Email: James@ArmorforAndroid.com; Twitter: @James_AfA

Armor for Android Additional Features

By James Green ~ April 8th, 2013 8:14 PM MST

MoreFeatures2MoreFeaturesAfALandingPageIn this tutorial we will discuss all the great features that are available in addition to the antivirus protection provided by Armor for Android. First, locate and open your Armor for Android application and navigate to the home screen.

There are three ways to access the additional features of Armor for Android from the application home screen First there is the green ‘Menu’ button in the top left corner of the home screen. There is a second green button along the bottom left corner of the screen labeled ‘More Features’. Finally there is the ‘More’ button that can be found on the right side of the blue menu bar. All of these buttons when selected this button will navigate to the additional features menu.  The ‘More Features’ and ‘More’ buttons towards the bottom of the screen are available from all screens of the application.

Once you have navigated to the additional features screen you can see that there are many additional features available with Armor for Android. Each feature that is included is designed to make it easy for users to improve device performance and maintain a high level of security for their devices. To gain a better understanding of each of these features we will discuss them individually in detail in the order they are listed in the additional features menu.

ListItemAV

The first feature listed is the Antivirus function; this is the main function of Armor for Android. If this feature is clicked you will be navigated back to the home screen where you may select Quick Scan, Deep Scan, SD Scan, and access the Security tab or Privacy tab of the application. All of these features are designed to defend the device against malware in the android environment. The three scan features will detect any potential malware on the device, provide the user further information about the threat, and assist in removing the threat from the device if the user deems it necessary. The privacy and security tabs help users manage the sensitive information stored on their devices to minimize the possibility of the information being misused or stolen. Each antivirus and security feature has been discussed in detail in individual tutorials; further information about any of the antivirus or security features can be found on the tutorials page.

SingnalBooster

SingalBosoterThe second item listed in the additional features menu is Signal Booster. If you are having trouble with dropped calls or a slow network connection Signal Booster can improve signal strength and network connection on the device. The Signal Booster interface resembles a radar screen that displays the location and proximity of all of the cell towers in your area. The cell tower that you are connected to is represented by the green icon; the grey icons are other cell towers in your area. If there is a cell tower that is closer to your location than the tower that you are connected to it may be able to provide you will better signal.

To improve signal select the ‘Boost Signal’ button, this will reset the radio on the device which connects to the cell towers. The device radio will reconnect to the tower with the strongest signal, potentially increasing the signal strength and network connection of the device. If you are already connected to the cell tower that is providing the strongest signal but still having problems with slow network connection or dropped calls move toward the tower; the closer you are to the cell tower the stronger the signal will become. Signal Booster’s radar interface displays the location of the tower and can lead you to the location of the cell tower to improve your connection.

ListItemPhoneFinder

The next feature listed is Phone Finder; this feature is designed to help users locate their device in the event that it is lost or stolen. Select phone finder to be taken the phone finder interface, you will be asked to either login or create and Armor for Android account. If you have already created an account simply enter you email address and password and your specific device will be registered to the Phone Finder feature. If you have not previously created your Armor for Android account select the “Create an account” link that is located above the Login button. To create an account an active email address will be required and you will be asked to create a password. A confirmation email will be sent to the email you provide to verify the account. Once the new account has been verified the device will be registered to the Phone Finder feature.

PhoneFinder PhoneFinder2 PhoneFinder3 PhoneFinder4

 

If the registered device is ever lost or stolen you can use Phone Finder to locate it. Using a computer go to ArmorforAndroid.com; there is a blue login button located in the top right corner of all pages of the website. Click on the login button and enter the same login credentials that were used to register the device to the Phone Finder feature. Once you have logged into your Armor for Android account you will be present with the Phone Finder web interface which will look like the screen shot below.

AFAPhoneFinderinterface

Phone Finder provides four different ways to locate the lost or stolen device. The First option listed is ‘Location’; this will display the GPS location of the device on a map in the web interface. GPS location is accurate within roughly ten meters so it will be able to tell you almost exactly where the device is…almost. GPS location will not be able to tell you that the lost device is behind the nightstand or under or in the loveseat cushions on the right side. Phone Finder provides three additional ways to locate a lost device in these situations. The ‘Siren’ option will make the device play a loud siren, this siren is loud and could be considered borderline obnoxious so you should be able to find your device under five feet of laundry. ‘Ring’ will command the device to play the preset ringtone; this will simulate a phone call and hopefully provide enough noise so that the device can be found. And finally, ‘Vibrate’ will initiate the vibrate feature of the device, this is a great option when a device is lost late at night and the rest of the household may be sleeping. All of these commands can be sent to the device by clicking the ‘Send’ button to the right of each option on the web interface. Commands will be canceled once the device is found and has been unlocked.

ListItemSpeedBooster

SpeedBooster

Speed Booster is a one-click performance enhancer for your Android device. If the device is operating slowly, applications are crashing, or your battery is being drained Speed Booster will optimize the device to improve the performance and increase battery life. Poor device performance can be caused by too many applications running the background, applications storing unnecessary data and clogging memory, the device browser storing unnecessary data taking up needed memory, or even the clipboard not being cleared and, again, taking up valuable memory space. Specifically, if the RAM memory is being bogged down with unnecessary data and operations it will cause the device performance to decline. By clearing unnecessary data stored on the RAM memory of the device the processor and the RAM will be able to communicate more freely which will improve the overall performance of the device substantially.

With one click the Speed Booster will clear all unnecessary data that is clogging up the device and close any unnecessary background operations. Some of the data that is stored, such as account login credentials or internet browsing history, represents a privacy threat. By clearing the unnecessary data stored on the device you not only improve device performance but also ensure the privacy of your sensitive information. The Speed Booster feature provided by Armor for Android makes it that easy for you to improve device performance, protect private information, and restore your Android device to its previous glory.

ListItemTaskKiller

TaskKiller3Task Killer is a handy central location to manage what applications are running in the background of your device. When you exit an application it does not close, it does not cease to run, instead it is moved to the background of the device and stays in the RAM memory. Applications that remain in the RAM memory can be loaded quickly and will open to the screen that they were previously operating on; this is a great feature that makes loading applications quick and easy. But applications that remain on the RAM memory take up space that could be used for other device processes, and if too many applications are taking up RAM memory it can cause the device to operate more slowly.

Task Killer displays a list of all of the applications operating in the background of the device. To stop any application from operating in the back ground (“kill” an application) select the application from the list and then press the large red “Kill Task” button in the top center of the screen. The more tasks that are stopped from operating in the background the more RAM memory will be freed up. More available RAM memory can be used for new processes and can increase device performance. Stopping applications from running in the background can also be done manually through the device settings. However this process would take significantly more time as each application would have to be “killed” individually. The Task Killer provided in the additional features provides a central location to quickly and easily stop multiple applications from running in the background of the device.

ListItemBattery

BatteryBoosterFor those times when your away from your charger and your battery is about to kick the bucket there is Battery Booster. Battery Booster is designed to optimize your device so that the remaining battery can power the device for a longer period of time. The Battery Booster interface also provides information about the device and the battery, such as battery type, temperature, and voltage. Power Tracker is an informative tool that breaks down the remaining battery life and displays this information as the amount of time remaining for different device functions. Some device functions use more battery power than others, phone calls uses less battery power than watching a video on the device; both of those functions use less battery power than surfing the internet. The Power Tracker feature of the Battery Booster allows users to view how long (HH:MM:SS) they will be able to perform any device function with the amount of battery that they have remaining.

To optimize the battery life of the device select the ‘Boost Now’ button. Battery Booster will make changes to the device settings such as dim the screen, turning off Wi-Fi or 3G, and turning off location services like GPS. Adjustments made will depend on the amount of battery remaining, if most of the battery still remains then Battery Booster will make few to no changes to the device. If there is only a sliver of battery remaining Battery Booster will make more substantial changes to get the most life out of the remaining battery.

ListItemUninstaller

The Easy Uninstaller is another central location where you can save time performing multiple tasks at once rather than completing each task individually. Applications can be uninstalled individually through the device settings, but if you are looking to free up large amounts of space on your device quickly it would be a hassle to go through and uninstall each application one at a time. The Easy Uninstaller allows you to select multiple applications to be uninstalled at once.

Uninstaller Uninstaller2 Uninstaller3 Uninstaller4

Easy Uninstaller will list all applications that have been installed on the device. To uninstall one or multiple applications select each application by clicking on the empty box next to each item you wish to uninstall. The empty box will be filled with a green check mark indicating that you wish to uninstall the selected application. Once you begin the uninstall process all items with a green check mark will be uninstalled. After you have selected all of the application that you wish to uninstall simply press the large red ‘Uninstall’ button in the top center of the screen. Easy Uninstaller will prompt you to confirm that you want to continue with the uninstallation, once you select ‘OK’ Easy Uninstaller will being uninstalling all of the application that you have selected.

ListItemMemoryBooster

Applications store information that may never be used again and this information can take up valuable memory on the device. This information can clog up memory but it also represents a privacy threat. Some of the information that is stored may be considered sensitive such as log in credentials or browser history, if this information is stolen from the device it can be used to harm the device owner. Memory Booster provides another central location to save time and space when clearing application data and cache. It is possible to clear this information manually but you would have to go through each application individually and clear the data and then clear the cache.

MemoryBooster MemoryBooster2 MemoryBooster3

 

Memory Booster will clear all application data and cache with only one click. Simply select the large red ‘Clear Cache’ button that is in the top center of the screen and all application data and cache will quickly disappear. Memory Booster will increase the storage available on the device, improve device performance, and help ensure that private information cannot be stolen from the device and used against the owners wishes.

ListItemSD

The Safe SD Installer ensures that all .apk’s that are installed on the device are safe prior to installation. Applications that are downloaded from Google Play are installed instantly making the two processes of downloading and installing seems like a single process. This means that Armor for Android can only scan these applications after they have already been installed on the device. However, when downloading an .apk from a third party android market or possibly an Android forum these two processes are clearly separate. Apk packages are downloaded to the SD card of the android device but not installed; using the Safe SD Installer Armor for Android can perform and antivirus scan on all .apk packages before they are installed.

SdInstaller SdInstaller2 SdInstaller3 SdInstaller4 SdInstaller5

To install an .apk package from the SD card go to the Safe SD Installer and select the desired package(s) from the list. A green check mark will indicate all packages that have been selected and will be installed. Once you have selected all of the packages press the large red ‘Install’ button in the top center of the screen. Armor for Android will then scan all .apk packages looking for malicious signatures. If the .apk package is clean the Safe SD Installer will prompt you to continue to install the package.

If the .apk that you were attempting to install is flagged as a potential threat the Safe SD Installer will alert the user prior to installation. If a potential threat is found the exact name of the threat will be displayed to the user. Armor for Android allows users to continue to install a potential threat if they so choose but we strongly recommend that you cancel the installation. Applications that are potential threats will generally initiate their malicious activity as soon as they are installed on the device. Potential threats can steal sensitive information, money, damage the device and put the device at greater risk of further malware infections. The Safe SD Installer is the first line of defense against installing any potentially malicious applications.

ListItemBlackListerr
PhoneBlacklisterTelemarketer calls are annoying, and car sales man can be relentless; Phone Blacklister provides users with a quick and easy way to manage who can contact them. Phone Blacklister can be used to block phone numbers from calling or sending text messages your device. The Phone Blacklister interface allows you to manage your blacklist, easily blacklist phone numbers that have recently contacted you, and view which blacklisted numbers have attempted to make contact with the device.

To blacklist a phone number and prevent either phone calls or text messages from being received simply click on either the recent calls or recent messages button. A list of all of the recent phone calls or messages will be displayed in each section. Click on the phone number that you wish to blacklist, you will be prompted to confirm the action, and the phone number will be blocked from either sending text messages or making phone calls to the device. To block a phone number from calling and text messaging the device go into each of the categories and select the number that you wish to blacklist. You can also manually add a phone number to be black listed in the black list section of the Phone Blacklister. Enter the phone number that you wish to block in the space provided and select enter and the number will be quickly blocked. You can manage your blacklist by selecting the Blacklist button. To remove any phone number from the blacklist click on the desired phone number and you will be prompted to “Remove from Blacklist?”. Click ‘OK’ and the number will be removed from the blacklist and will be able to send text message or make phone calls to the device again. ♦

James Green is a mobile security researcher who has worked in the Android security field for several years providing privacy and security advice to Android users. Email: James@ArmorforAndroid.com; Twitter: @James_AfA

Armor for Android Settings

By James Green ~ April 8th, 2013 8:08 PM MST

At Armor for Android we aim to provide our users with the best antivirus protection available while also being the most user friendly application. In this tutorial we will discuss the settings found on Armor for Android that provide users options when using our antivirus application. To begin, locate and open your Armor for Android application and navigate to the home screen so that your screen is similar to the one below.

AfALandingArrow SettingsTab

The settings icon is located in the top right corner of the home screen. Click on this icon and you will be taken to the settings section of Armor for Android which should resemble the second screen shot above. These settings are designed to ensure the best possible protection as well as provide users with the ability to customize some features to their specific needs. We will discuss each setting in the order that they appear on the screen.

RealTimeScanning

This setting makes it easy for users to ensure that any newly installed application can be trusted. Armor for Android will automatically scan each application that is installed from the android market(s) and advises the user if the application is a potential threat. If a newly installed application is found to be a threat Armor for Android will alert the user immediately. Armor for Android recommends that each newly installed application be scanned and if a threat is found that the application be removed.

AutoDeepScan

Armor for Android provides a one-click feature that allows users to ensure that their device will be scanned weekly without further interaction. Just like a computer should be scanned weekly, so too should your Android device. By enabling this feature Armor for Android will automatically Deep Scan the device once a week to ensure that there are no potential threats; if any threats are found Armor for Android will alert the user with a notification in the notification bar.

DeepScanOnlyonWifi

A Deep Scan requires an internet connection to connect to the HackerTrapp Cloud Database. Any unknown threat will be scanned for malware signatures via the cloud scan. While data usage is minimal some users without unlimited data plans and who also have heavy data usage may be concerned about overages and can use this feature to ensure that Deep Scans are only preformed on Wi-Fi.

DeepScanWhenCharging

This setting allows you to conserve on battery while using Armor for Android. While a Deep Scan is not a considerable drain on the battery of the device, users with low remaining battery or users who will be away from their chargers for an extended period of time can use this setting to ensure battery usage is kept to a minimum.

notifications

When a potential threat is discovered by Armor for Android a notification is placed in the notification bar to alert the user. Some users however prefer to go without notifications and would rather check back manually. This setting allows users to toggle notifications ON or OFF.

SystemApps

System applications will generally not be flagged as potential threats; however, if a system application has a specific level of permissions it may result in the application being flagged as a potential threat. System applications cannot be uninstalled from the device unless the device has been rooted. This setting allows users to remove system applications from being scanned to prevent an application that cannot be uninstalled being flagged as a potential threat.

ScanBeforeInstall

This setting is for out of market applications such as .apk packages installed from an email, SD card or a third party android market. This setting allows these packages to be scanned after they are downloaded and prior to installation on the device. If the .apk is scanned and found to be a potential threat Armor for Android will prompt the user to ‘continue’ or ‘cancel’ the installation of the package. Armor for Android does not recommend installing any .apk found to be a potential threat.

These settings provide users the ability to customize the level of protection they receive and the ability to conserve on device usage if necessary. Armor for Android recommends that users enable the security features found in the settings section (such as ‘Real-Time Scanning’, ‘Auto Deep Scan’, and ‘Scan Before App Install’) for the highest level of protection possible. It is up to the preference of each individual user to control when a Deep Scan is performed by toggling the ‘Deep Scan on Wi-Fi Only’ and “Only Deep Scan When Charging’ settings. Notifications are also a user preference setting but we recommend that users enable ‘Notifications’ as they are the quickest way to alert you to potential threats.♦

James Green is a mobile security researcher who has worked in the Android security field for several years providing privacy and security advice to Android users. Email: James@ArmorforAndroid.com; Twitter: @James_AfA

Quick Scan vs. Deep Scan and Threat Removal

By James Green ~ April 5th, 2013 4:24 PM MST

AfALandingPageAfALandingPageArrows

Armor for Android allows you to scan all of the application on your device for potential threats. Scanning your device is simple; locate and open Armor for Android on your device and navigate to the home screen. When you have reached the home screen your devices screen should resemble the screen shots on the right.

On the screen you will notice that you can perform two kinds of scans either a Quick Scan or a Deep Scan. The Quick Scan feature scans all of the applications on your device and compares the device contents to our comprehensive threat database called Hacker Trapp. If a known potential threat from our Hacker Trapp data base is found on the device it will be flagged as a potential threat and the user will be alerted.

The Deep Scan feature is a more comprehensive scan that may also require more time to complete. Deep Scan will also scan all of the applications on the device and compare them to our comprehensive threat database Hacker Trapp and alert the user to any known potential threats found. If the Deep scan encounters any applications that have not been previously encountered the application will be uploaded for a “cloud scan”. A “Cloud Scan” will scan the source code of the application looking for malware signatures. If any potentially malicious code is discovered the application will be flagged as malware and the user will be alerted. This process can take some time to complete depending on your network connectivity so please keep this in mind.

Now that you know the difference between Quick Scan and Deep Scan, choose the scan option that fits your needs and allow Armor for Android time to complete the scan. Once the scan has been completed Armor for Android will alert you if any potential threats have been found. If a potential threat has been found click on the “Fix Now” button and you will be taken to a screen like the one below, where a list of all of the potential threats will be displayed.

AfAScaninProgress AfAScanCompleteArrow AfAThreatsPage

By clicking on any potential threat and you will be presented with a brief description of the threat. You will also be presented with two options regarding how to proceed with any threat.

AfABreifThreatDescriptionBOX AfATrustThreatBOX AFAWooBooThreatBOX


You can either ‘Uninstall’ a potential threat or chose to ‘Trust’ the potential threat. Uninstalling the threat is recommended, this will completely remove the potential threat from your device. Uninstalling a threat is very easy, simply click the uninstall button and you will be taken to another screen where you will be asked to confirm the uninstall. Click “OK” and the threat will quickly be uninstalled form the device.

AfABreifThreatDescriptionArrow AfAUninstallScreenArrow AfAUninstalling

Trusting a threat should only be done if you are 100% certain of its integrity; this will stop the threat from being returned in any future scans. If you feel that an application is 100% trustworthy and has been wrongly flagged as a potential threat you can select the “Trust” button and the application will be removed from potential threat list. In the example below we used the EICAR test virus that is used to test antivirus software. The EICAR test virus was developed by the European Institute for Computer Antivirus Research and is designed to have malware signatures but no malicious function. If you would like to test the Trust feature yourself you can download the EICAR test virus for free from the Google play store.

AfATrustThreatArrow AfAProtected

Once you have uninstalled or trusted all of the threats found on the device you will see the screen above with the green “Protected” icon. This is to signify that your device is safe and threat free. A threat free device ensures the safety of all sensitive information stored on the device.

All Armor for Android users should strive to keep their devices threat free at all times. The Quick Scan feature allows users on the go to quickly scan their devices and make sure that their information is safe and secure. Deep Scan provides a more comprehensive scan that will ensure all applications on the device are trustworthy and can discover never before encountered threats. Both of these feature help users remove the threats from their device, and in the event of a false positive Armor for Android allows users to trust threats to prevent future detections.

For more information on the other great features of Armor for Android and other tutorials designed to educate users visit our tutorial page. Please also visit our blog for more information about the Android threat landscape, and for tips about using your Android safely in a sometimes dangerous Android environment. ♦

James Green is a mobile security researcher who has worked in the Android security field for several years providing privacy and security advice to Android users. Email: James@ArmorforAndroid.com; Twitter: @James_AfA

Armor for Android Privacy Features

By James Green ~ April 5th, 2013 4:23 PM MST

Armor for Android takes your privacy seriously and provides you a fast and easy way to maintain the potentially sensitive information on your device. In this tutorial we will be explaining in greater detail the features of the Privacy tab that can be found on the blue menu bar in your Armor for Android application. To begin with, locate and open Armor for Android on your device. Once the application is open you will see a screen similar to the screen shot below.

AfALanding AfALandingBOX

As you can see, this device has a large green “Protected” icon in the center of the screen which means there are no malware threats found on the device. This is a great start but there are still security concerns to be found. There are nine Privacy threats which are indicated by the small numeric icon on the privacy tab. Select the Privacy tab and you will be taken to the following screen:

AfAPrivacytab AfAPrivacytab2

This device has never before used the privacy features; the information contained on this device is at risk if the device were lost or stolen or if the device became infected with malware. As this may also be your first time visiting the privacy tab let’s go over each of the items and how they represent a privacy threat.

Browser History – Browser history can be harvested by malware and may be of interest if an unauthorized individual were to gain access to the device. By selecting clear browser history the potentially sensitive information stored in all browsers (both default and third party) will be cleared.

Search History – Search engines store the history of each search preformed on the device. This information is potentially sensitive and could be of interested to unauthorized parties and may be harvested by malware. All search engine history (Google, Bing, Yahoo, etc) can be cleared by selecting this item and pressing the “Clear Now” button.

Text Messages – In addition to personally sensitive information contained in text messages, banks send users verification codes, account balances and account alerts via text message. Some Android malware is specifically designed to harvest bank text messages and in the case of a lost or stolen device these banking text messages represent a substantial risk.

Market History – Just as browser history and search engine history can be a concern, so too can market history. Market history contains all of the applications that have been downloaded to the device and may be of interest to a potential intruder and can be harvest by malware.

Clipboard – One of the more commonly over looked privacy threats. Clipboard history represents a significant privacy threat and contains anything that the user has copied and pasted or cut and pasted.

Video/Photo Message History – Videos and pictures sent via MMS messages are sensitive information that the device user would likely not like to have stolen. Clearing your video and picture messaging history ensures that the content of the messages both sent and received do not fall into the wrong hands.

Call Logs – This information is commonly harvest by malware and can be at risk if an unauthorized party were to gain access to the device.

Gmail History – This information may allow unauthorized parties or malware to gain access to your Gmail account and emails that could contain personal or financial information

Map History – Map history allows both malware and an individual with unauthorized access to view your recent GPS locations which is a significant privacy threat.

The privacy tab provides a singular location where all of this information can be managed and cleared. It is advised to clear all of the privacy threats on this list but you may also chose to only clear select items. Select the privacy threats that you wish to clear by clicking on the empty box on the right had side of each category. Once you have selected all of the items you wish to clear press the large green button in the center of the screen with the text “Clear Now” and Armor for Android will begin clearing all of the selected privacy threats.

AfAPrivacytabSELECTED AfAPrivacySCANNING

Once Armor for Android has completed clearing the selected privacy threats a date and time will be seen underneath each threat heading. This is the date and time that each threat has last been cleared.

AfAPrivacyScanComplete

Armor for Android users should regularly clear their sensitive data to protect themselves in the case of a lost or stolen device. All of the categories listed in the Privacy tab represent some form of a privacy threat and Armor for Android recommends that users clear all information in this section. If you should chose not to clear all of the privacy threats please be vigilant in removing sensitive information that can be found in each category. ♦

James Green is a mobile security researcher who has worked in the Android security field for several years providing privacy and security advice to Android users. Email: James@ArmorforAndroid.com; Twitter: @James_AfA