Today Google has released its 4th annual so-called "Android security year in review," a number-heavy report meant to demonstrate the improvements made over the last year when it comes to security. And it's not just ego-stroking, Android made great strides during 2017 on the subject. From the launch of Play Protect to increased distribution of security patches, Android as a platform has never been more secure.
For the full details, you can read the report in its entirety, but the short version is that most of the enhancements to Android security experienced over 2017 stem from Play Protect, announced in May 2017 at Google I/O. This is in contrast to last year's report for 2016, which mostly focused on the impact of expanded SafetyNet tools, increased security patch distribution, climbing API levels, and platform improvements in Android Nougat 7.0. But for Android security, 2017 is the year of Play Protect.
As a malware detection method it's been a bit hit and miss, but Play Protect does fill a necessary void. It's no longer possible for every app that exists to be individually reviewed and verified at a detailed level—just ask Cody, our APK Teardowns are serious work—but the vast majority of malware out there isn't original, and Play Protect can scan against a known library to catch most of it.
Thanks to Play Protect, Google's detection rate for "Potentially Harmful Apps" (an actual technical classification) is up significantly. If you were unaware, your Play Store-equipped Android phone actually scans installed apps at least once a day to check for PHAs, taking action if any are discovered. And it doesn't just protect you from apps installed via the Play Store, sideloaded apps (which are generally more sketchy) are also scanned. So even if you're nine times more likely to get a Potentially Harmful App installing them from other sources, Google and Play Protect are still working hard to keep you safer.
Notable facts and figures from this year's report include:
- Over 50 billion apps scanned by Play Protect daily.
- 60% of Potentially Harmful Apps found by Play Protect were detected by machine learning.
- 39 million PHAs were removed from devices last year.
- An additional 10 million PHAs were caught before they were even installed since October.
- Installation rates for Potentially Harmful Apps installed outside of Google Play are down 60%.
- 30% more devices received security updates last year compared to 2016.
- No critical vulnerabilities were disclosed without an update or mitigation strategy already available.
- A total of $1.28 million was paid to researchers in the Android Security Rewards program.
Google is also happy to reiterate its hardware and software performance at the 2017 Mobile Pwn2Own hacking contest. At the event, no exploits were able to compromise Google's Pixel phones, and none of the exploits demonstrated for Android at the event were able to work on pure AOSP—likely meaning that those which were demonstrated only worked on modified Android software (i.e., OEM skins/ROMs).
Of course, Google isn't resting. In the latest Android P developer previews, the company has been rolling out even more features to enhance user security. As good a year as 2017 may have been for Android security improvements, 2018 should probably be even better.