Test: Security Apps for Androids

 1 Background

So far, none of the Android phones used by CartONG on the field got lost or went missing, however, in order to have the possibility to trace a lost phone, it is necessary to install a security app on it. For this test, only free apps which work without a SIM card were considered. Since none of the survey Androids carries any SIM; the security system needs to be able to function without it. Whereas it would potentially be possible to budget for a Paid Security App, this would not easily be manageable, and therefore free apps are preferred. The following security apps, recommended by various blogsites were chosen:

Prey http://preyproject.com/, Where’s My Droid http://wheresmydroid.com/, AntiDT http://www.antidroidtheft.com/ and avastMobileSecurity http://www.avast.com/en-gb/free-mobile-security.

 2 Setting

Utilized in this test: For setting up the webpage for the tracking, Windows computer, for testing the application: Samsung Galaxy Tab GT-P1000, Samsung Galaxy GT I9000 Android phone as well as the HTC Desire Z. Other requirements: Android Marketplace account

Note: Setting up a user account is mandatory for the test. In fact, the Apps in both cases CANNOT be downloaded through any other but the Android market which is a concern as this requires the setup of Android Market account and Googlemail on the phones and therefore violates privacy and is unpractical when using non-personalized phones. Exception: Prey, which is an app that also runs on laptop, e.g. Windows, Linux, IOS, MAC, Ubuntu, Android. However, the Android version can also only be downloaded from the Android Market.

Not all tested security applications do work for non-personalized phones (e.g. without SIM card) in the FREE version. Refer to the Chapters below for more details.

 3 Applications

 3.1 Prey

Figure 1: Price ranges for Prey Pro

 3.1.1 Setup

The set-up is straight forward; after creating a Password and an account (it is faster to create it online), the app can be entered and settings like the activation and deactivation message, as well as SIM detection, keypad lock and the general account management can be changed here. An interesting feature to have is to block uninstallation. Without knowing the password, the application cannot be removed.

 3.1.2 Webtracking and Activation

There is a possibility to track the devices online and set them to the state “Missing”. However, in the free version, activation can only happen by sending an sms; e.g. for devices without SIM card this is not an option. If your device was stolen, it is quite likely that the SIM will be exchanged at a stage; therefore activation needs to happen almost in real time before the SIM gets swapped. Activation is straight forward and more than one device can be tracked simultaneously. The tracking consists of a report, listing the specifics of the missing phone and a map interface showing the location of the phone. The phone needs to be on WIFI or on GSM for the details to be transmitted.

Figure 3: The Prey Online Tracking, the Tab GT P1000 cannot be activated.

Figure 4: The Prey Online Tracking, a mapping position gets transmitted for the Galaxy with SIM card. However, when WIFI is switched off, it cannot be tracked even if the SIM card is still in.

Figure 5: Warning message; when activating keylock at the same time, it is possible that the message will not be readable since the keyboard locks first.

3.2 Where is my Droid? “Where is my Droid” is maintained by an Android developer and operates under a Creative Commons Attribution 3.0 Unported CC BY 3.0 license. Apart from a free version, he also offers a Pro Version which comes with more functions like wiping the SD card and the device, locking the device as well as more customizations. The Pro version is available for 3.99 USD. “When you lose your phone while the ringer is turned off it can be impossible to find it. Where’s My Droid fixes that problem. After texting your phone a custom attention word the app turns the ringer volume up and makes your phone ring. It’s also possible to get latitude and longitude and a link to Google maps. Interesting features: this app can work with WIFI connection only and therefore is suitable for devices without SIM cards. The device needs to be connected to an existing Google account. Another interesting feature is the Lite version which claims to be installable from remote, e.g. when the device is already lost. However, a data connection and a registered Google account are necessary for it to function.

 3.2.1 Setup

The set-up is straight forward, when entering the app, the ringtone, as well as the GPS setup, the security settings (White/Black list, Passcode for locking the keyboard and SIM changes, rest Pro Features) can be set. On the commander menu you can connect or disconnect your device from the web interface. The Advance menu allows you to set the device into stealth mode, meaning all incoming messages are hidden.

 3.2.2 Webtracking and Activation

There is a possibility to track the devices online with the Where’s My Droid Commander. You need your Google account you used for the setup to log-in. You can get the status, make your device ring, get the quick GPS and an accurate GPS. Devices are not tracked simultaneously and it seems as if the application has difficulties getting a status fix if two phones are set up with the same Google account. However, the functions will perform for both phones, e.g. both will start ringing or have a message sent. The commander interface does not have a mapping module integrated, but will show the position on Google Maps in a separate window.

Figure 7: The WMD commander tracking the Galaxy Tablet without SIM Card.	Figure 8: The Position is being submitted can be viewed in Google Maps.
Figure 9: Phone starts ringing and will switch off when tapping on “Found Phone” or when the selected ring period is over.	Figure 10: The position can be traced on Google maps.

 3.3 AntiDT

Anti Droid Theft is maintained by a company called Zobo Technologies, based in Manitoba, Canada. There is no specification on the license. The application does not have a Pro version, but you can donate to the developer. This app can work with WIFI connection only and therefore is suitable for devices without SIM cards. The device needs to be connected to an email account and WIFI needs to be enabled. Another interesting feature is the Spy cam option; when triggered the phone will take a secret picture and submit to the web service.

 3.3.1 Setup

The set-up is straight forward; in fact it only consists of setting a password and starting the service. The interface allows you to disable the service and email the password.

 3.3.2 Webtracking and Activation

There is a possibility to track the devices online. You can decide to view the location in an inbuilt Google map window and trigger a spy photo. It will take some time to upload; for both, The Samsung phone and the tab, it took next to 20 min before the image and the location where received. For the Tab (no SIM Card) a location could not be logged which suggests that the GPS service is built on the network provider and not on the inbuilt GPS device. The web app is a little buggy. Even when deleting the app completely from a device, it will retain the last phone specifications which have been associated with the email account used to register. If this does not get fixed, you will not be able to change the phone you track and keep your existing email.

Figure 11: ADT has tracked the phone with SIM and displays its location.	Figure 12: The Tab (No SIM) cannot be tracked and therefore only submits the spy photo
Figure 13: The Spy Photo taken from the phone with SIM.

 3.4 avastMobileSecurity

AvastMobileSecurity is maintained by AVAST, a company who also hold the full copyright for the app. The application is free. This is the most comprehensive app on the market, since it also contains features for internet security.
Interesting features: Remote Wipe and the possibility to hide the app under a different name (For instance “Cow Race”). The type of tracking is triggered by a list of commands which are preceded by the AVAST password. The list is extensive and the creation of your own remote commands is possible, too. AVAST claims that the application cannot be uninstalled, even when rooting the phone.
Whereas the internet security part also runs on a Tab, the AntiTheft functions at the moment can only be enabled via sms and therefore cannot be utilized for devices without SIM cards.

 3.4.1 Setup

The set-up is more complex, since you need to pay attention to the settings of the security app and the Antitheft app and moreover write down your password very carefully! Since you are not registering with an email account, there is currently no way to retrieve your AVAST password. Without it, you can’t change any settings and you can’t send any SMS commands which have to be preceded by the Password. (4-6 Digits). You can only remove the app with the Anti-Theft removal wizard and your password.

 3.4.2 Webtracking and Activation

There is no real online tracking utility available at the moment. Tracking is achieved through the sms commands and the position of the device can be ascertained when clicking on the link provided in the sms.

Figure 15: Avast sends the tracking messages including location by sms to a number which has been set up.	Figure 16: Avast in disguise; Cow Race.
Figure 17: Avast tracking when clicking on the link sent in the S?S.

4 Results

All four applications track an Android device with a SIM card successfully. The quality of the GPS locations differs and is seems to be better when the device is on WIFI. None of the applications seem to rely on the GPS functionality alone, but use the network provider’s information as well. All applications have the main functionalities: tracking, lock display, siren and display a message. However, for the Android survey context; the usability of the applications is limited; despite the fact that all applications stated that they are usable without GSM as long as WIFI is available. All of the tested applications which function on tablets need the phone to be set up with an email address, for Where’s My Droid it needs to be a Google account.

 4.1.1 Issues encountered with the apps

Prey:

• The GPS coordinates which were submitted when the phone is on GSM were off by almost 2km! The coordinates are only accurate when the phone is on WIFI
• Devices without SIM cards can only be tracked when upgrading to the Pro-Version.

Where’s my Droid:

• Every device you track needs to be set up with a different Google account.
• The free application comes with a lot of ads and frequently displayed upgrade messages.
• Application can easily be uninstalled.

AntiDT:

• Devices without SIM cards do not submit coordinates and can only sent Spy photos.
• The application takes long to track and keeps a device linked to an account even if that device has been disconnected and the app deleted from the phone. If this issue is not going to be fixed, one can simply run out of the email addresses to use.
• Application can easily be uninstalled

avastMobileSecurity:

• You need another mobile phone with SIM to receive the notifications since there is no web tracking. For people with only one mobile or SIM card, this is a problem.
• Devices without SIM cards cannot be used.
• The GPS tracking when on GSM can be off by more than 200 m; even though the accuracy in this case was estimated at 15 m.
• It is difficult to remember all the various commands.

The following table gives an overview of the functionalities of all four security apps.

5    Conclusion and Recommendations

• AvastMobileSecurity is the most comprehensive program and plans to include WIFI based systems without SIMcard and web online tracking in the near future for the AntiTheft component. The internet security already functions for tablets but is potentially only needed when a lot of data and apps are being downloaded. It is recommended to have a closer look and re-evaluate once the web component has become available.

• None of the applications in their current state meet all the requirements for non-personalized mobile phones used for surveys. It is easier to give recommendations for personalized phones, for instance phones on loan to a country operation where one person is being responsible for an individual phone.

The final recommendations are as follows:

GO FOR                                                                                Individual Phones with SIM Card

• AVAST MOBILE SECURITY; if you have an alternative phone with a second SIM card, ELSE
• PREY

GO FOR                                                                     Individual looked after Phones, No SIM Card

• Where’s my Droid (you need to set up your Google account, Pro version is good value; track your personal phone with another APP, since you will run out of Google accounts…)

GO FOR                                                                     Phones in the survey batch, No SIM Card

• PREY (if you can afford the plan; which is costly unless a good NonProfit rate can be negotiated), ELSE
• Where is my Droid – with the creation of a generic Google account for all phones this becomes feasible, however tracking them simultaneously would be a mess, therefore when a phone needs to be tracked, all others should be disconnected from the Commander. This might get buggy as the app is not intended to work this way. It was found that the phone occasionally rings even when being disconnected, for instance.
• Wait for the development/update of AVAST or AntiDT.

Note: Development for Android based systems is progressing fast. Any of the functionalities can change. It is also possible to involve the Open Source community and/or invest money to have the ideal application tailored to protect a number of devices under one plan.