If a user downloads apps from third-party app stores, however, he faces two possible threats: rogue/spyware applications and premium SMS apps.
Android 4.2 however effectively deals with those two last threats as well, and now we know how.
Bouncer, Google Play's security system in a nutshell
A little disclaimer to be perfectly exact: it is not impossible to circumvent the Bouncer system as it runs a virtual environment and that could be detected, but it is extremely hard to crack it. And given the consequences for the developer account that does, it is hard to imagine Android security cracked.
Now, Bouncer is pretty much a sealed box for the public. Reverse-engineering it, though, has revealed that what it does is effectively detect the most common threats from spyware and premiums SMS apps. If an app tries to steal your contacts, Bouncer detects it. If an app tries to send a message to a premium number, Bouncer detects it. If an app, steals your photos? You guessed it right, Bouncer detects it.
Android 4.2 brings Bouncer to sideloaded apps
The new service is not mandatory in a typical open Google fashion. The first time you try to sideload an app on your Android 4.2 device, a pop-up will appear asking you whether you want to verify apps. Best of all, when an app raises some red flags with its behavior, but can’t be definitely written off as malware, you get to choose whether to install it or not AFTER reviewing what it has access to. This way, even if you are paranoid about security, you still would not need to read every single time the components an app has permissions to access.
And even the permissions screen has been tweaked adding illustrative icons, so you can take a quick glance instead of reading it.
This is definitely another huge step for Android security and reiterates Google’s commitment to openness. Instead of leaving its app protection system for the Play Store only, the company spreads it to sideloaded apps and thus makes third-party app catalogs more secure. We can only applaud Google for that.
source: Computer World
App permissions on Android 4.1 (left) and 4.2 (right)