Now someone just needs to write an app that monitors for this app.
The malware/anti-malware wars have begun on Android!
The malware/anti-malware wars have begun on Android!
1) You can generate and load new classes at runtime, making it impossible to do complete static analysis on things running on the Dalvik side of things.
2) You can run native code, allowing you to circumvent static verification in about a billion different ways. Note that they could take the Google Native Client approach and force binaries to be statically verifiable to a large extent, but then you can't JITC code.
Static analysis, while cool, is not the solution to problems like this. The solution is fine-grained authorizations to access, which Android is already half way there on. Honestly, the problem with authorizations isn't a technical one (especially when you enforce a pure-managed code system like Dalvik), but a user experience one.
That said, some degree of runtime analysis to verify that an application is not trying to escape its bounds can be helpful.
In terms of locking down an Android box, well, the least they could is what you suggest, fine-grained control. Flash apps have this, there is a bit in the file that allows the applet to choose between file-system access and network access. I thought that was clever. Another thing is to allow applications to send back only data that they bring in (i.e. for version verification.) along with a generic set of data about device capabilities, location, etc.
I like that is like the desktop and open enough to be abused. I prefer that to approval process based systems.
I like that the choice is available (the world would be a poorer one if it didn't have such systems for people who want them), but this makes me just that much more happy with my iPhone. For me.
Not that such a thing would be impossible with an iPhone, of course: someone could jailbreak it and install a similar app. But it'd certainly be harder and more time-consuming.
If I download Firefox on your desktop and hide it, is it really fair to call it malware?
edit: Especially since it's not on the Market, so someone has to be messing with your phone quite a bit to go find the link, download it, enable non-Market sources and install it. Again, I just don't feel that it deserves to be lumped in as "malware". I feel like malware is something that a user gets on accident. Not something that someone physically intentionally installs.