Advice Request Default-deny Android security suite

[TheMalwareMaster]

Is there any default-deny security software for android, similar to what COMODO does on windows?
It must deny installation of apps not inside its proprietary whitelist.

It’s not for me but for another person. Thanks!

 

[Ice Dream']

nah..
unlike generic desktop based linux or windows, Android does it via SELinux(kernel) and uses firejail by default, so anything is isolated from the core, similar to how MacOS does it, by using enforced sandbox for everything you run on.
uh, so... yeah, you're left with the fact that for these type of scenarios, high-paid enterprise tools exists, i.e MDM.

but belive me, Android does it by default, if you also run a VPN on top, you're basically making your already device impossible to be hacked
and unless said the hacking, if someone really finds you with dropped trousers, that someone needs an enormous amount of financial and electronic device resources just to get you. Ever since the late security-patches of Android, starting from v14, Google made it extremely isolated from any outside noise.
is really hard to hack even a outdated Android 13 device, not mentioning v15

but my question, why did "swim" needed this in the first place

 

[TheMalwareMaster]

nah..
unlike generic desktop based linux or windows, Android does it via SELinux(kernel) and uses firejail by default, so anything is isolated from the core, similar to how MacOS does it, by using enforced sandbox for everything you run on.
uh, so... yeah, you're left with the fact that for these type of scenarios, high-paid enterprise tools exists, i.e MDM.

but belive me, Android does it by default, if you also run a VPN on top, you're basically making your already device impossible to be hacked
and unless said the hacking, if someone really finds you with dropped trousers, that someone needs an enormous amount of financial and electronic device resources just to get you. Ever since the late security-patches of Android, starting from v14, Google made it extremely isolated from any outside noise.
is really hard to hack even a outdated Android 13 device, not mentioning v15

but my question, why did "swim" needed this in the first place

But malware for android still exists right? So how is it possible that malware exists if it’s so “isolated”?

 

[oldschool]

GrapheneOS is the most secure Android OS. It makes available the the latest Android security preview releases as soon as they are available and has a slew of hardening features via its exploit protections. Users can continue to use it like other Android phones if they choose via its sandboxed Google Play and Play Services. It will run all Android apps except a small number of payment services and banking apps. GOS is used by journalists and activists around the world who are safer as a result.

Currently only available on Google Pixel phones but coming soon to Motorola flagship phones as their initial offering of GOS-compatible phones.

 

[Ice Dream']

But malware for android still exists right? So how is it possible that malware exists if it’s so “isolated”?

It very much depends on what that malware acts on, not when, it acts then. Let's take a huge .mvk film/video... no android AV can detect a buffer data overflow, but the integrated kernel which has some things I cannot recall atm, maybe someone can be nice to fill this spot on the map, it detects it and isolates it within a dedicated sandbox
the said, sandbox, is separated from the hardware and software, so the virus thinks is running but it just sits there
simply put, this sd let's live for a few short moments before excerting control and that's when the virus become nulls, it cannot touch the integrity of your device.
some malware can take a shortcut and attack it in return, but the said user already knows and the Android recommends to answer with "App keep stopping" !

the 2nd shortcut, it directly attaches to your said device and the only result is to either factory reset or visit a GSM to swipe out the memory MMC

 

[Ice Dream']

it took me a while but am cooking and running low on battery
pretty much this is it, for the average user intelectual at least
doesn't mean you shouldn't have a AV installed on your device to scan certain things, I put my hands on IKARUS/Sophos. Both free, at least since dec 2025 ikarus now is.
good to have, but i'll never scan enormous files, it just checks the hashes and it could miss
AV on Android have a lot of limits, even if IKARUS is the better one out of most, mainly because of it's enterprise engine

 

[TheMalwareMaster]

GrapheneOS is the most secure Android OS. It makes available the the latest Android security preview releases as soon as they are available and has a slew of hardening features via its exploit protections. Users can continue to use it like other Android phones if they choose via its sandboxed Google Play and Play Services. It will run all Android apps except a small number of payment services and banking apps. GOS is used by journalists and activists around the world who are safer as a result.

Currently only available on Google Pixel phones but coming soon to Motorola flagship phones as their initial offering of GOS-compatible phones.

I don't need such a high hardening - I would just need some app that asks for a password before installing any android app.

Anyway at the moment I am using BD free (for my mother) but I noticed that BD paid version has introduced some sort of behavioural blocker, which is unique on android

 

[ghostkernel]

But malware for android still exists right? So how is it possible that malware exists if it’s so “isolated”?

It still exists because users are manipulated into giving permissions, misconfigured third party apps can be exploited, and low level vulnerabilities in the kernel and drivers can be exploited as well.

 

[Zero Knowledge]

if you also run a VPN on top, you're basically making your already device impossible to be hacked

Yeah but nah mate. This is not correct. VPN makes zero difference. If Android never got hacked why do we need monthly security updates?

You should know Android/iOS is where the majority of exploits and hacking are focused on now.

 

[Marko :)]

But malware for android still exists right? So how is it possible that malware exists if it’s so “isolated”?

It does exist, but it not the type of malware you know from Windows. Apps on Android are separated and no app can touch any other. Hence, malicious apps on Android are limited what they can do. Most of them are just what would be classified as adware on Windows.

Unless you give malicious apps all permissions they request, they are useless and can't do anything. So my recommendation is to stick with popular apps, preferably open source and to never give apps any permissions that isn't necessary for the functionality and you'll be safe.

Antivirus for Android also isn't necessary. Every single one of them is everything except the antivirus itself. They do advertise and call these apps antivirus in order to convince people they need one so people would buy it. Typical AV industry scam.

 

[Ice Dream']

Yeah but nah mate. This is not correct. VPN makes zero difference. If Android never got hacked why do we need monthly security updates?

You should know Android/iOS is where the majority of exploits and hacking are focused on now.

true, in a tiny amount of perspective
so this is mainly an optional security step that should get paired with the uh, kill switch lever.
it has a magic effect if, and only if, the said attacking doesn't happen on your IP, if it does somehow discover your IP which any ISP should by default hide it in the router only, and the outside being just a "Hi, look at me" aka a mask, then yes.. VPN in that situation makes no difference and your prone to call your ISP in case of DDoS, remote hacking via port scanning or something along the lines of uncovering a CVE. They should prevent this outerspace behaviour by their efforts, but this is just the 10% of the problem, other 90 falls on the Android. I know situations where ISP fixed some remote influence by themselves so hence why I mentioned it in the first place.
Bottom line, yes, VPN can help but it doesn't at the same time, my main card draw with what I said was that, if you're a bit careful and use this on top of this carefulness, you can get a decent combo. Or again, other steps are to route via a local laptop+PiHole proxy, but it requires some user input that isn't easily accesible, here you can benefit from many other things, not found in our current talk.
so the resume this, apple is quite a few steps back behind google, at least on the mobile market. Google strived to make their ecosystem quite hard to get for outsiders, in the last say... 1.5-2 years. It's a reason why Google wins, Apple mainly wins on the anti-theft part and will always do, for some reasons. Not saying big G doesn't but not in their manner.

The monthly security updates will always be better in OnePlus or Pixel gama. Samsung poke their nose a bit too much and they were recently found with a critical 8yo CVE still not fixed.
Motorola with the Graphene partnership could shift the tectonic plates for a bit, but is still inmature, for most users while a huge + for me or people who do got an idea of how to pair two wires between them, is still not there. Google wins here, and yes is a debate where I firmly stand with big G, in the security realm.

 

[RoboMan]

I don't need such a high hardening - I would just need some app that asks for a password before installing any android app.

On supported Galaxy devices, there's Auto Blocker which can prevent APKs from being installed from unauthorized sources. There's also Maximum restrictions for Auto Blocker, which adds several additional security controls.

And with Lock Auto Blocker, the protection can be locked so that another person can't simply go into Settings and turn Auto Blocker off without authenticating with the phone's lock-screen credential.

It's not exactly a password prompt saying “enter a password to install this APK”. Instead, the model is more like:

APK from unauthorized source - installation blocked - protection can't simply be disabled without authentication.

That's probably much closer to what you want than a traditional anti-executable application.

 

[RoboMan]

Had to google it, but here's what Auto Blocker with Maximum Restrictions does

• App Protection: automatically scans installed apps for viruses and spyware/malicious activity.
• Blocks device-admin apps: prevents activation of apps that obtain device-administrator privileges.
• Blocks work profiles: prevents activation of work profiles.
• Blocks 2G: prevents connections to legacy 2G cellular networks.
• Blocks automatic reconnection to unsecured Wi-Fi: the phone won't automatically reconnect to previously used insecure networks.
• Blocks hyperlinks and previews in messages: reduces the chance of accidentally opening malicious links or content.
• Blocks shared Gallery albums: prevents creating or joining shared albums.
• Strips location metadata from shared photos: removes location information before sharing pictures.

 

[TheMalwareMaster]

On supported Galaxy devices, there's Auto Blocker which can prevent APKs from being installed from unauthorized sources. There's also Maximum restrictions for Auto Blocker, which adds several additional security controls.

And with Lock Auto Blocker, the protection can be locked so that another person can't simply go into Settings and turn Auto Blocker off without authenticating with the phone's lock-screen credential.

It's not exactly a password prompt saying “enter a password to install this APK”. Instead, the model is more like:

APK from unauthorized source - installation blocked - protection can't simply be disabled without authentication.

That's probably much closer to what you want than a traditional anti-executable application.

This is great! Will look into it