Most iOS users are surprised to learn that apps that advertise themselves as “antivirus” or “virus scanners” on the App Store cannot actually scan for viruses, let alone spyware and malware. Huh? What?! Yeah, it’s true, it is not possible for 3rd party apps (i.e. ones not from Apple) to access the operating system or system files directly or to access files in other apps to scan them due to what is called app “sandboxing”. Sandboxing is a feature in iOS that isolates apps for privacy and security reasons. This includes antivirus apps from all of the major antivirus companies.
We’ll explain at the end how Am I Secure? is able to avoid these restrictions and successfully detect spyware, malware and viruses on iOS.
On Android, unlike iOS, it is possible for apps to request special permissions that allow them to access more data than normal outside of the app sandbox, such as all files on the device, to perform virus scanning but this level of access is not permitted on iOS, even if the user wanted to grant it. Due to this, many vendors play sneaky games where they advertise the features of their Android antivirus app while not clarifying that the features are not possible on the iOS version of their app. This feels like a class action lawsuit against them waiting to happen.
So what do these “antivirus” apps on the App Store actually do if they are not able to scan for viruses? They generally provide the following features to give the impression of having security value while implying that they can scan for viruses.
- Device security check: all they are doing is checking if your device is on the latest version of iOS and if a passcode is set, nothing more, often with a fake “scanning” screen that runs for a few seconds to make it look as if your device is actually being scanned. You don’t need an app to tell you these two checks! Some throw in a “jailbreak” check but such checks cannot detect advanced spyware. We do many more checks than this and do so for FREE and only include the iOS version and passcode checks since users expect it from security apps. We have a “scanning” button and screen too but it is because it takes time for our iCloud Private Relay check to complete, something is actually happening in the background.
- Malicious web site blocking: they claim to protect your iOS device by blocking malicious web sites. Here’s a little secret, no one has a list of the handful of web sites that are actively attacking iOS devices right now. Such web sites are usually targeted to specific victims, hand crafted to go after one specific person. The part of the web site containing the attack is not available to anyone but the victim, attackers limit access to the malicious portion of the site to only IP address ranges associated with their victims to protect the technology being used to attack from being discovered. As a result, security researchers have a hard time obtaining the attack exploits and confirming the site is malicious even in the rare occurrence where a potential victim shares the web site with them. If you are outside of the victim’s IP address range you get a safe non-malicious version of the web site. All these antivirus companies are doing is using lists of web sites that are known to be malicious to Windows systems and occasionally macOS and Android, totally irrelevant to iOS. Zero protection or security value for your iOS device.
- “Safe” network check: looking for “Man-in-the-Middle” (MitM) attacks against common domains, i.e. someone trying to break the encryption between your device and a server. Our app does this for FREE, others make you pay for it.
- Identity “protection”: there isn’t really any protection since that implies they help protect your identity from being stolen in the first place, when all they do is alert you that your information has shown up somewhere on the Internet as part of a breach of a company. You can do this yourself for FREE by visiting a popular site https://haveibeenpwned.com (not affiliated at all with our company), a site that is likely much more comprehensive and timely than the apps offering identity “protection”. Google’s “Google One” service also offers a paid “dark web report” that can alert you when your information shows up online.
- VPN service: we don’t generally recommend using a VPN since most of the communications leaving your device these days are already encrypted and trusting a sketchy VPN company with your network traffic allows them to use it for all sorts of malicious purposes. Many of the antivirus apps actually outsource their VPN service in the background to other companies, ones you have never heard of. In North America and Western Europe, we’d sooner trust our local Internet Service Provider (ISP) or cellular/mobile company to handle our network traffic directly. This assessment changes of course if you live in authoritarian countries where Internet access is restricted and/or your local network connectivity can be used to exploit your device. You can also create your own VPN server and use it, the best option no matter where you live! Recently a number of VPN apps on iOS have also been impacted by the “TunnelVision” vulnerability, so if you are using one, it is worth searching for more info on it from sources other than your VPN company’s web site.
- Phishing web site blocking: finally, something these apps can actually do that might be useful and improve your security, blocking web sites that pretend to be a legitimate web site, like your bank, to trick you in to logging in to them to steal your username and password. Even here though, the value this feature offers is questionable since such web sites are put up and taken down rapidly so by the time they are discovered and blocked in the app, the site might not even be online anymore. Sophisticated users aware of cybersecurity threats already know what to look for to avoid phishing sites and most users access their bank and other major sites via an app, not via the web browser.
Common Questions We Get About iOS Antivirus Apps
Don't antivirus apps have special entitlements from Apple to be able to access everything required for virus scanning?
While there are special entitlements one can receive from Apple, no such entitlement that would cover this exists. So no, Apple does not allow anyone this access, even major antivirus vendors.
Don't antivirus apps use privilege escalation exploits to break out of the sandbox to be able to scan?
No. Even if an antivirus vendor had such exploits, using them would for sure get a company banned from the App Store but would also rapidly result in the exploit being discovered and patched by Apple so it would only be useful for a very short period of time.
A competing app says it can also detect Pegasus spyware, how is that possible if it is limited to the app sandbox?
One version of Pegasus spyware, a version that is years old now, was detectable from within the app sandbox and one competing app uses this fact to make it sound like it can detect current infections of Pegasus. After this version was discovered by researchers at Citizen Lab at the University of Toronto, the NSO Group, the creator of Pegasus, rapidly modified it to ensure that it never again left indicators that were detectable from within the app sandbox. The check this app includes was useful years ago and only for a few days before the spyware was updated. No app currently on the App Store other than Am I Secure? is able to detect current versions of spyware, malware or viruses.
How Am I Secure? works
Am I Secure? is the only app using a new technique where the user, via iOS, generates system diagnostic data (“sysdiagnose”) and then shares it with our app for analysis. By doing so it allows the Am I Secure? app to access data outside of the app “sandbox” to detect spyware, malware and viruses. Am I Secure? is the ONLY app using this technique and therefore the only app that can actually detect spyware, malware and viruses. Our company has been using this approach to analyze iOS devices for a number of years now and are the only company with widespread experience in this technique with a custom “sysdiagnose” analyzer suite we use to check each submission from our users. Before our app, clients submitted sysdiagnose files to us via email, the app opens up spyware detection to a much wider audience.
As you may have noticed, we haven’t updated our blog in a while, we focussed on communications on Twitter/X, but we will once again be routinely updating our blog and notifying users of updates in the app.
