Most free security apps do not guard against Android malware

If you’ve been using a free Android anti-malware app to protect your phone against malicious software, take note.

According to tests conducted by AV-Test, which bills itself as an independent IT security and anti-virus research specialist, the most popular free anti-malware apps on the Android Market do not offer reliable protection against malware. The company also partners with PC World magazine to review security products.

Zoner AntiVirus Free was the only free app with a respectable result in the test. The security app, which boasts of 50,000 to 100,000 installations, detected eight out of 10 malicious apps.

BluePoint AntiVirus Free, Kinetoo Malware Scan and Privateer Lite warned against one malicious app, while Antivirus Free by Creative Apps, GuardX Antivirus and LabMSF Antivirus beta failed to detect any malware completely. In comparison, commercial apps by F-Secure and Kaspersky detected all threats without a problem.

Security researchers at Romanian security software company BitDefender recently warned that the number of Android malware could swell from 200 today to 12,000 by March 2012, according to a September report by The Register.

In June this year, researchers at North Carolina State University identified a new Android malware called DroidKungFu that avoids detection by masquerading as a VPN client.

“DroidKungFu clearly represents the next evolution in mobile malware,” said Derek Manky, senior security strategist at Fortinet, a provider of network security appliances.

“Where earlier attempts at Android malware, such as Zeus in the Mobile (Zitmo), are able to intercept the type of two-factor authentication that banks use to validate the identity of the account holder when logging in, DroidKungFu does much more,” he noted.

“By disguising itself as a legitimate VPN client application, the malware quickly gains root access to the device using social engineering. Once executed, DroidKungFu has the ability to download further malware, open URLs in a browser, start programs and delete files on the system,” Manky said in a media statement.