I took a look and noticed some apps from fdroid repo are marked to have viruses, in some cases even 20 virustotal engines find a trojan virus.
The application that I use from time to time and that is APK Extractor, and I was really surprised that it is marked with 7 virustotal engine as a virus trojan.
–
Here we come to the question
Are all applications on the f-droid safe to use?
Does the app pass any security and safety tests before appearing on the F-droid?
While some think any open source application is secure, it can normally be malicious.
Dunno… but if it’s on F-Droid it has been build from source code, so you can easily check whatever the snake-oilvirus scanner says.
in some cases even 20 virustotal engines find a trojan virus.
Link?
Does the app pass any security and safety tests before appearing on the F-droid?
Yes, Virustotal, so what does that site show you as infected if the apps are marked as clean by Virustotal when we scan? Eg. Look at some of those with 1 (one) malware…scroll down…see “Virustotal says clean”…that table is dumb.
While some think any open source application is secure, it can normally be malicious.
Of course, just that it’s a bit harder to do this when the source is in the open.
VirusTotal has funky UX. When you scan URLs it doesn’t run filetype specific scans. When you use their upload form you’ll find it’ll run APK specific scanners which then will yield some virus warnings.
Also F-Droid generates indiviudal signing certificates for each and every app. So it’s perfectly fine that all those APKs have differnt key fingerprints.
My experience with VT is: It’s a good indicator – but you cannot rely solely on its results. Snake Oil “Virus-Scanners” are known to produce false positives. Some of them produce even more than others. There are several engines I simply ignore when they’re the only ones “finding” something (and it’s no exception that some weeks later I find VT has kicked out that engine altogether). Use with care and cross-check with other resources.
What I strongly dislike is: each finding at best gives you a “cryptic name” without any details (or I just didn’t figure yet how to get to those details). When I tried to use that “cryptic name” with a web search, I wasn’t wiser afterwards.
I start getting very suspicious when 5 or more engines agree, not before.
Also depends heavily on the application. APK Extractor ? Sounds like some hacking tool and is thus probably detected like any other development tool also. (For example cheat engine)
Anecdote:
It can be something pretty simple like write an application that uses the low-level global hotkey detection in windows, and it’ll be detected as keylogger. Virus detection can’t see what I’m using that API for, it’s just seeing that it’s used. Had to use that to circumvent some programs that try to catch all keyboard inputs and disable global hotkeys. (yes, games do that…) so if I wanted to still use a hotkey, I’ve had to take this route
VirusTotal is a bad choice if you’re privacy-conscious, since it’s owned by Google. I use OPSWAT Metadefender. https://metadefender.opswat.com/
ClamAV is also famously more paranoid than a chicken in a thunderstorm. Once I scanned a brand new Windows 7 install with it and it nuked half the exe files on the PC.
Snake oil… See my intro for (and the links at the end of) Anti-Virus, Anti-Malware, Anti-Theft. We do run APKs through VirusTotal and see such false positives from time to time. VT runs stuff through 60+ engines, which makes it easier to spot them: if just 1 or 2 report something, it’s very likely a false positive.
AV apps on your Android device are mostly a greater risk by themselves. Many security researchers would classify them malware or at least PUA. Have you counted the trackers contained in your Kaspersky – or in McAffee, or Avira? Better keep those off your device. If you insist, there’s one clean AV app, and you can get it at (surprise!) F-Droid: Hypatia.
My kerpasky flagged a virus from the music app built and signed be Fdroid. I double checked it with virus total and it detected 5 instances.
Is this a legit virus?
