FAQs, Tips, and How-to:

Android Security FAQ

Is Android secure?

The security and privacy of our users' data is of primary importance to the Android Open Source Project. We are dedicated to building and maintaining one of the most secure mobile platforms available while still fulfilling our goal of opening the mobile device space to innovation and competition.

A comprehensive overview of the Android security model and Android security processes is provided in the Android Open Source Project Website.

Application developers play an important part in the security of Android. The Android Platform provides developers with a rich security model that to request the capabilities, or access, needed by their application and to define new capabilities that other applications can request. The Android user can choose to grant or deny an application's request for certain capabilities on the handset.

We have made great efforts to secure the Android platform, but it is inevitable that security bugs will be found in any system of this complexity. Therefore, the Android team works hard to find new bugs internally and responds quickly and professionally to vulnerability reports from external researchers.

I think I found a security flaw. How do I report it?

You can reach the Android security team at security@android.com. If you like, you can protect your message using our PGP key.

We appreciate researchers practicing responsible disclosure by emailing us with a detailed summary of the issue and keeping the issue confidential while users are at risk. In return, we will make sure to keep the researcher informed of our progress in issuing a fix and will properly credit the reporter(s) when we provide the patch. We will always move swiftly to mitigate or fix an externally-reported flaw and provide updates to users.

How can I stay informed about Android security?

For general discussion of Android platform security, or how to use security features in your Android application, please subscribe to android-security-discuss.

How do I securely use my Android phone?

Android was designed so that you can safely use your phone without making any changes to the device or installing any special software. Android applications run in an Application Sandbox that limits access to sensitive information or data with the users permission.

To fully benefit from the security protections in Android, it is important that users only download and install software from known sources.

As an open platform, Android allows users to visit any website and load software from any developer onto a device. As with a home PC, the user must be aware of who is providing the software they are downloading and must decide whether they want to grant the application the capabilities it requests. This decision can be informed by the user's judgment of the software developer's trustworthiness, and where the software came from.

I think I found malicious software being distributed for Android. How can I help?

Like any other platform, it will be possible for unethical developers to create malicious software, known as malware, for Android. If you think somebody is trying to spread malware, please let us know at security@android.com. Please include as much detail about the application as possible, with the location it is being distributed from and why you suspect it of being malicious software.

The term malicious software is subjective, and we cannot make an exhaustive definition. Some examples of what the Android Security Team believes to be malicious software is any application that:

  • uses a bug or security vulnerability to gain permissions that have not been granted by the user
  • shows the user unsolicited messages (especially messages urging the user to buy something);
  • resists (or attempts to resist) the user's effort to uninstall it;
  • attempts to automatically spread itself to other devices;
  • hides its files and/or processes;
  • discloses the user's private information to a third party, without the user's knowledge and consent;
  • destroys the user's data (or the device itself) without the user's knowledge and consent;
  • impersonates the user (such as by sending email or buying things from a web store) without the user's knowledge and consent; or
  • otherwise degrades the user's experience with the device.

How do Android-powered devices receive security fixes?

The manufacturer of each device is responsible for distributing software upgrades for it, including security fixes. Many devices will update themselves automatically with software downloaded "over the air", while some devices require the user to upgrade them manually.

Google provides software updates for a number of Android devices, including the Nexus series of devices, using an "over the air" (OTA) update. These updates may include security fixes as well as new features.

Can I get a fix directly from the Android Platform Project?

Android is a mobile platform that is released as open source and available for free use by anybody. This means that there are many Android-based products available to consumers, and most of them are created without the knowledge or participation of the Android Open Source Project. Like the maintainers of other open source projects, we cannot build and release patches for the entire ecosystem of products using Android. Instead, we will work diligently to find and fix flaws as quickly as possible and to distribute those fixes to the manufacturers of the products through the open source project.

If you are making an Android-powered device and would like to know how you can properly support your customers by keeping abreast of software updates, please contact us at info@openhandsetalliance.com.

↑ Go to top

← Back to FAQs, Tips, and How-to