TrustGo Antivirus and Mobile Security 1.3.3 (for Android)
As a totally free security suite, TrustGo is something of a rarity in Google Play where freemium and subscription models predominate among security apps. Better still, TrustGo provides the usual slate of anti-theft tools along with top-tier malware protection and an interesting app certification system, giving you information about apps before you download them.However, my enthusiasm for TrustGo is tempered by issues I have with how it remotely locks the device, which I believe leaves the device vulnerable.
Poorly implemented anti-theft lockscreen. No SIM card alerts. Spy camera images delivered via email.
TrustGo brings top-rated malware, anti-theft protection, and system management at an unbeatable price, but its approach to anti-theft still needs to mature.
TrustGo Antivirus and Mobile Security 1.3.3 (for Android)
Free: Yes, Yes
Focused on Apps
What separates TrustGo from products like Kaspersky Mobile Security is that it focuses on apps. In the App Manager tab, you’ll be presented with a list of popular apps that TrustGo has scanned and certified as safe to use. According to TrustGo, the company scans 400 app marketplaces around the world, and gathers information from users to stay abreast of new Android apps. For users this is a first line of defense against malicious applications.
The My Apps sub tab will give you information on what’s installed on your device, but is irritatingly not open by default.
From here, you can uninstall an app in seconds, or report it to TrustGo for unusual behavior. The reporting feature is a bit odd since it requires users to do a bit of investigation on their own, but is certainly useful for TrustGo to keep informed about the app ecosystem.
From the Security screen, you can access Privacy Guard. This breaks down the permissions requested by apps into broad categories, giving you a bird’s eye view of what kind of information your apps can access. If TrustGo has flagged an app as insecure or unsafe it will provide more information on the risks presented by the app. Unfortunately, Android does not provide granular permissions control, requiring users to either take the risk or uninstall the app. Tapping on an app in Privacy Guard list allows you to uninstall it, and also indicates whether the app has been certified by TrustGo.
Note that not all suspicious apps will be flagged in Privacy Guard, only apps which TrustGo believes could expose your personal information.
Scanning and Impact on the User
Even the scans carried out by TrustGo’s Security Scanner are focused on apps, though it will run through every available file on your phone as soon as you tap the scan option from the homescreen. Kaspersky Mobile Security, on the other hand, gives you the option of a targeted folder, app-only, or full system scan as well as other options.
Like other security apps, TrustGo scans new apps as their installed for potential threats. According the app’s developers, the app can identify potential threats even in apps the company has never seen before thanks to heuristic scans performed on the device.
It took TrustGo an average of 62.4 seconds to scan 238 apps and other assorted files while a dozen other apps were running. This was well behind the much faster Bitdefender, but still fast enough to where it wouldn’t impact the user.
Version 1.3.2 of TrustGo introduced significant changes to the anti-malware engine, which caused the app to jump to the top of AV-Test’s January 2013 results with a perfect score. This independent testing lab also praised the additional features of the app, giving it a perfect usability score. PC Mag currently does not perform mobile malware detection evaluations in-house.
With TrustGo installed, there’s minimal impact on the user. The phone is still fast and responsive, even with a scan running. I didn’t notice any stuttering or lag playing Minecraft on my Samsung Galaxy Note II $749.99 at Amazon while TrustGo was scanning (even with 11 other apps running). With the TrustGo installed, it takes an average of 25.3 seconds to boot up the phone, and only another five seconds after that before the TrustGo logo appears on the top bar.
TrustGo can do SD card scanning and schedules weekly scans by default. I’d like to see scheduled scans made optional by default, however, since performance is critical with mobile devices.
Identifying and Removing Suspicious Apps
To see how TrustGo handled potentially malicious apps, I installed a penetration testing app that is frequently flagged as malware. After I installed the test app, TrustGo popped up a warning which I was pleased to note categorized it as a low threat, and also included information about the app. Most security apps do not provide information about why they flag the apps that they do. However, enough time had elapsed that I could have easily opened the suspicious app before TrustGo’s warning appeared.
From this warning I could uninstall the app or add it to my list of ignored apps. Once ignored, TrustGo will not include the app in its list of possible threats during a system scan. Tapping delete here, or in the scan results, opens the Android uninstaller and removes the app.
During my testing on the Samsung Galaxy Note II, I had a few instances where the Android uninstaller failed to launch after I tapped delete. I was not able to replicate this issue, but for any security app you should check to make sure the uninstall was successful if you don’t see a confirmation screen.
Similar to the Privacy Guard information, TrustGo pulls some of Android’s security-related settings and puts them in one easily accessible spot. From the System Management button, you can set limits on your mobile data, see your overall data consumption, and see how much data has been used by individual apps.
For those concerned about battery life, TrustGo also provides estimated durations for various activities. Tapping the lightning bolt button takes you to one of TrustGo’s more unusual sections, where it appears to be breaking down what percentage of your battery time each app is consuming. Presumably this battery information is an amalgamation of how much RAM and CPU time each app is consuming, however it’s poorly explained and one of the few times where TrustGo does a worse job than Android’s default system options. This could be a powerful (pun intended) feature with just a little more explanation.
Lastly, the Free Memory section shows a graph of how much RAM your device has available. Tapping the X to the right will shut down many of the apps, potentially freeing up more space for better performance. This shortcuts entering the Android settings menu and shutting down apps one at a time to free up memory. However, some critical processes will be automatically restarted. When I tapped the X it said 36 apps had been shut down but that might be a bit confusing because when I tapped it again it reported the same thing.
These are all features available from the Android settings menu and TrustGo should be commended on making them easy to find and improving usability. I think that by gathering these settings together and associating the, with the idea of security can help make users—particularly new users—more security conscious.
Backed Up to the Cloud
Google already stores a back up of your Android device’s settings, passwords, WiFi networks, and so on, but TrustGo can supplement that with a free back up of your SMS messages, call log, and contacts. Backing up the information is a snap; it took me only 4.9 seconds to move the measly 304kb of data onto TrustGo’s system. You can also trigger a backup remotely from the TrustGo web portal. This is smart, because it lets you secure your information before utilizing anti-theft options like remote wipe.
On my Samsung Galaxy S III $189.99 at Amazon Wireless, I successfully recovered my data both before and after a total system wipe. If you’re going to use this feature after recovering a lost or stolen phone, be sure that you begin a restore as soon as you re-install TrustGo. If you create a new back up, your old data will be lost forever.
Like many other Android security apps, TrustGo has a secure browsing feature that the company claims can keep you safe while you cruise the web. Once activated, Secure Web Browsing works with the default Android browser, Google’s Chrome, and the Dolphin browser. This gives you some flexibility about how to interact with the Internet while still being protected by TrustGo.
In my test, I found little impact on website load times while using the stock browser on the Samsung Galaxy Note II. Running the Acid 3 test to 100 took an average of 3.36 seconds, which was not demonstrably longer than loading the page without TrustGo’s security.
Without question, the biggest single risk to your device and its data is simple theft. Like many security apps, TrustGo offers several anti-theft features accessible from a web portal. From here, you can track your device’s location, lock it, activate an alarm, or wipe its memory. Unlike Trend Micro and other security apps, TrustGo does not warn you when the SIM card is removed or replaced.
The web portal is a little confusing, since it places most of the anti-theft features under the Find My Phone section of the Trusted Cloud menu. From here, TrustGo will automatically locate your device and display it on a Google Maps map. As with all security apps, if your device cannot establish a reliable data connection your device won’t be located right away. Also, the Android OS will indicate that the GPS has been activated in the status bar.
Unlike other security apps, TrustGo has integrated the ability to snap a photo of whomever is in possession of your lost device with its remote lockscreen. If someone fails three times to enter the correct unlock code, TrustGo will activate the device’s front-facing camera and snap a photo, which is then sent to the email address associated with your TrustGo account. While I’m glad to see this included in the app, I prefer having the flexibility to take photos on demand.
I was pleased to note that the remotely activated alarm was piercingly loud. Though the Android OS automatically re-routes the alarm through any connected headphones, it makes the device extremely unpleasant to use.
Unlike other security apps, you can un-do many of these options remotely as well. In my testing, I found that I was able to quickly activate a remote lock and the alarm options, as well as undo them within seconds. This is a welcome addition since it allows you to regain control of your device without having to enter pesky codes. It also makes it easier to shut off the alarm once you’ve recovered your phone—either from a thief or an unkempt bedroom.
When all else fails, the Web portal allows you to delete any combination of your device’s SMS history, call logs, contacts, and accounts. You can also choose a factory reset, which will perform the above actions by default. You can also remotely wipe your SD card.
On the subject of removing data, TrustGo even makes it simple to remove your device from their web service as well as purge all the data relating to your device. For those concerned about their data hanging around on company servers, this is a welcome addition.
However, I was disconcerted to note that it is easy to circumvent the TrustGo lockscreen which appears after the device is remotely locked. It requires no trickery: simply tap the home button and you’re at the homescreen. You can pull down from the top of the screen and access the Notification Center, as well as GPS, WiFi, and other options—which notably could be used to prevent further commands from being sent to the device
I also found that you can activate apps on the homescreen even when the device has no Android lockscreen passcode but is locked by TrustGo. This was true for the Samsung Note II, Galaxy S III, and Nexus 7 tablet. The newly released 1.3.3 version of TrustGo more effectively blocks the ability to access the recent apps task manager.
Admittedly, the TrustGo lockscreen re-appears as soon as the device goes to sleep or if you attempt to tap on an app providing some degree of protection—particularly against people who might know your device passcode I also wasn’t able to deactivate TrustGo while the device was locked. I must also point out that other security apps, like Trend Micro, had similar lockscreen issues. Kaspersky Mobile Security and BitDefender, however, did not.
It’s already been demonstrated that an attacker can do quite a bit of damage with just seconds of access to the homescreen but even without a fancy exploit the TrustGo lockscreen doesn’t keep an attacker from looking at messages in your notification center. However, it should be noted that you can set a passcode and timeout-lock for your Android device your device will be much safer than without one.
I was prepared to give TrustGo a higher score based on its performance in independent labs, its attractive interface, and robust features. However, the behavior of the device while locked remotely gives me pause because theft and direct attack is the biggest threat to any mobile device. I feel that this undercuts the app’s ability to serve as an all-in-one security suite, though I have to point out that other security apps like Trend Micro and Lookout have similar issues and that you should always lock your Android with a device passcode.
The recently released version 1.3.3 of TrustGo removes the ability to view running apps, and is a positive step forward from the developer.
TrustGo provides top-tier malware detection built around an ambitious app scanning scheme. It rounds out its features with system management options and handy metrics which are convenient and easy to use—especially for new Android users. Weigh those benefits and its price tag against its lockscreen behavior.