[Android Software/Hacking General [Developers Only]] codesplice:
Lookout / McAfee WaveSecure [APPs]

I've got a special double-feature for you today, highlighting two of my favorite mobile security apps. Unfortunately, neither is yet to the point that I can completely replace one with the other, so I currently have both installed on my device. Read on...

---------------------------------------------------

App Name: McAfee WaveSecure (v.4.0.0.4)

Developer: McAfee, Inc.

Price: $19.90/yr Subscription (required; app is available as 7-day free trial)

McAfee WaveSecure is arguably one of the most-known mobile security solutions, and with good reason. WaveSecure got some pretty excellent press in the Spring of 2010 when a relatively-unknown blogger posted an account of his experience with WaveSecure, in which the app enabled him to have his phone back in his hands 24 hours after it was stolen. Who wouldn't want such protection for their expensive mobile device - not to mention all the sensitive data stored within its circuitry?

WaveSecure offers three main functions, all available from your account page on the WaveSecure website: Track & Lock, Remote Backup, and Remote Wipe. If your phone was to be lost or stolen, these functions would be able to help get your phone back - or, at the least, ensure that your personal data isn't compromised. Track & Lock allows you to use the web-based interface to plot your phone's current GPS (or network-based) location onto a Map, and/or to completely lock down the device so that it is unusable until your special PIN is entered. During my testing of the app on my device (that is, without anything as geeky as an ADB USB connection), I tried for several hours to find a way around the lockscreen and was unable to make any progress. This lock is VERY secure. The Remote Backup function will periodically (or on-demand) backup your recent call log, messages, contacts, and media to WaveSecure's servers. You can access this data from the web interface, or restore it to your phone (or a replacement, if necessary) once the WaveSecure app is installed and associated with your account. And as a last-ditch protection, the Remote Wipe feature will securely erase all private user data off of the device to eliminate the risk of your personal information being compromised by a criminal. The Remote Wipe section on the web interface provides fine-grained control over what, specifically, should be wiped, allowing you to select to wipe Contacts, SMS, Photos, Videos, Call Logs, and/or your entire SD card.

Another totally-excellent feature of WaveSecure is a function to track what SIM card is currently inserted into the phone. You can view this information on the WaveSecure website, and (if necessary) pass a stolen phone's new phone number on to The Authorities. WaveSecure will also automatically lock down the device if an unknown SIM is inserted. But what if a morally-challenged person decides to remove WaveSecure from their "new" phone before you have the chance to lock it down? I'm glad you asked. WaveSecure offers an optional Uninstall Protection Add-on which will lock down the device as soon as it detects that WaveSecure has been uninstalled. Additionally, WaveSecure will lock down if the UPA is removed. This is a fabulous safety feature (though unnecessary on Froyo and newer devices, as WaveSecure should be enabled as a Device Administrator on these versions of Android). For added uninstall protection, WaveSecure also supports being installed to the /system partition of a rooted Android phone.

In its current version, WaveSecure does not offer any protection against viruses or other malware (you may scoff, but Android received its first credible virus threat in August of 2010, and there have been several viruses, trojans, and other malware reported since then). Since WaveSecure was purchased by McAfee within the past few months, I can only imagine that they are working hard to create a viable mobile antivirus solution to go with WaveSecure - though there has been no official word on such development. If you're looking to protect yourself from malware, you will need to look elsewhere for now.

Also note that WaveSecure communicates lock/wipe/track commands with your phone via SMS control messages, so if you do not have an unlimited messaging plan you could be surprised by some additional messaging charges.

Verdict: WaveSecure provides excellent peace of mind should your phone come up missing, but won't protect you from viruses and malicious apps at the current time.

---------------------------------------------------

App Name: Lookout Mobile Security (v.5.5.1)

Developer: Lookout, Inc.

Price: FREE (app and basic functions); $2.90/mo or $29.99/yr Premium Subscription (optional)

If you are interested in protecting your mobile device from viruses and other malware, Lookout Mobile Security is one application that I can highly recommend. The application is completely free (for life!) and does not require a subscription for most of its functions.

Lookout provides complete protection from viruses, spyware, and other malicious apps. It will automagically scan each app you install to make sure that it is safe, and will block any known malware applications. Lookout also provides on-demand scanning of your entire phone, and can additionally be set to scan weekly or daily. Lookout's antivirus database is updated regularly (and automatically, without any user interaction) to keep you protected from any emerging malware threats.

Similar to WaveSecure, Lookout also provides a function to find your lost or stolen phone and will plot its current location on a Google map. Something that really impressed me about Lookout's location feature is that you don't have to be stuck at your computer waiting for the location request to be processed by your phone - Lookout will send you an email when your phone has been found, with easy links to its location on a map. Additionally, Lookout enables the user to activate a loud "Scream" alarm on the device to help you find it (if you happen to have misplaced your phone inside your house, for instance) or to draw attention to a thief. Lookout also has a Backup & Restore function to backup Contacts, Call Logs, and Pictures. As an added nice feature, Lookout can send weekly (or daily, if you prefer) summary reports to your email to tell you about any recent events (such as Location requests and application scans). All of these "remote" functions are managed from an easy-to-use web interface.

And that's all with the completely, 100%, forever-free version of Lookout.

If you upgrade to the $2.90/mo (or $29.99/yr) Premium service, you get a nice set of additional features. Lookout Premium provides a Remote Lock function to securely prevent access to your phone and personal information by unauthorized persons, as well as a Remote Wipe capability to eliminate all traces of your personal data (including anything stored on your SD card) should your phone come up missing. These functions mirror, to some extent, those offered by WaveSecure.

The Premium version also gets you access to the Privacy Advisor function, which analyzes the permissions available to your installed applications and will let you view detailed summaries of what apps have access to what (in particular, which apps can access your Location, Identify Information, and SMS Messages). Note that this does not find any malicious apps, and makes no consideration for what an application does with your data; Privacy Advisor just provides a nice interface to allow you to make informed decisions about whether or not the usefulness of an application outweighs the risk of it having access to your personal information. You might sometimes be surprised by which apps you have allowed to read your dirty text messages!

At the current time, Lookout does not provide any protection against uninstallation of the app, nor does it provide a SIM-lock function like WaveSecure does. Lookout also uses SMS messages to control your device, but can also use wireless (3G or WiFi) data to communicate with the Lookout servers. Lookout will "phone home" over to check for any pending Track/Lock/Wipe commands each time a data connection is enabled. Even if your phone has been powered off for three days, when it is finally powered on and connects to the internet, that two-day-old Location request will be processed - and then you'll receive a handy email notification that it has been successful.

Verdict: Solid malware protection and location-tracking make the free version a must-have application; purchase a Premium subscription for added security.

---------------------------------------------------

Lookout, Inc also provides a free application called Plan B, which functions like a "morning-after pill" for your lost phone. In the event that you refuse to follow my advice and don't install either Lookout or WaveSecure on your phone BEFORE it goes missing, you can install Plan B (via the Market Website) without needing to do anything on your phone. Once installed, Plan B will determine your phone's current location and email it to your gmail (or Google Accounts) email address.

There are also Norton and AVG mobile security products available on the Market. My brief tests with those apps showed them to have great potential, but their current versions can't compete with the free version of Lookout in my opinion.

---------------------------------------------------

At current, I have both WaveSecure and Lookout installed (and subscribed to) for their overlapping protection - Lookout for malware protection, and WaveSecure for unstopable missing device security functions.

Screenshots:

1) WaveSecure PIN-protected Launch screen

2) WaveSecure Lock screen. Yes, the last four of my phone number is 1337 ;)

3) WaveSecure Main screen

4) Lookout Main screen

5) Lookout Security Scan in progress

6) Lookout Privacy Scan in progress

7) Lookout Privacy Scan Results. I mentioned that I have a lot of apps, right?