The latest Android security threat is nothing to worry about

You’ve probably seen people talking about a new threat to Android security. Apparently a rogue Android Trojan will use PayPal to steal $1,000 of your local currency at a time without much input from the user. However, most people have absolutely nothing to worry about.

The app, which is a battery optimization tool, has to be downloaded from a third-party source. It is not available on the Google Play Store. This already severely limits the danger as most people do not download apps outside of the Play Store.

However, Android’s security isn’t limited to having apps on the Play Store scanned. The operating system itself has plenty of safeguards to prevent security threats like this. Android won’t let you install third-party apps without bypassing a warning and enabling third-party sources, so if someone tries to do this, they’re acknowledging that what they are doing is dangerous.

The next level of security is permission control. The app won’t work without a user granting it permission to “Observe your actions.” This isn’t a simple permission either, but rather an accessibility service that must be manually toggled. This isn’t just a yes or no prompt.

If you’ve done all of that, then you’re in trouble. The app will send a notification pretending to be PayPal and claiming urgency and bring you into the official PayPal app. You log in and then it clicks various prompts to send the money to someone’s PayPal account.

Is this an actual Android issue? Absolutely not. A user would have to bypass multiple security barriers, complete with warnings, to get this scam to work. Most people wouldn’t even download an app outside of the Play Store, but those who will are usually not going to be providing said apps accessibility permissions. So if you read this story, don’t worry. There’s nothing for most people to fear. And if you get a call from the IRS asking for hundreds of dollars in gift cards, don’t you do it!

Plus battery optimization apps are criminally useless anyway.

source: androidandme