TrustGo Antivirus and Mobile Security 1.3.2 (for Android) review

TrustGo brings top-rated malware protection at an unbeatable price, but its anti-theft options don't seem secure at all.
Photo of TrustGo Antivirus and Mobile Security 1.3.2 (for Android)

This review should be a “zero to hero” story, given the enormous jump TrustGo has taken in tests from independent antivirus labs. Coupled with features offered by many other security suites at the low, low price of nothing should have made this app-focused security suite a slam-dunk. But the app’s poor implementation of anti-theft features and some issues removing suspected malware means it won’t be taking a high score.

Focused on Apps
What separates TrustGo from products like Kaspersky Mobile Security is that it is focused on apps. In the App Manager tab, you’ll be presented with a list of popular apps that TrustGo has scanned and certified as safe to use. The My Apps sub tab will give you information on what’s installed on your device, but is irritatingly not open by default.

From My Apps, you can uninstall an app in seconds, or report it to TrustGo for unusual behavior. The uninstall feature, while welcome, is simply a shortcut to the built-in uninstall feature in Android. The reporting feature is a bit odd since it requires users to do a bit of investigation on their own, but is certainly useful for TrustGo to keep informed about the app ecosystem.

From the Security screen, you can access Privacy Guard. This breaks down the permissions requested by apps into broad categories, giving you a bird’s eye view of what kind of information your apps can access. Unfortunately, there’s not much you can do with this knowledge. Tapping on an app in the list allows you to uninstall it, and also indicates whether the app has been certified by TrustGo.

Scanning and Impact on the User
Even the scans carried out by TrustGo’s Security Scanner are focused on apps, though it will run through every available file on your phone as soon as you tap the scan option from the homescreen. Kaspersky Mobile Security, on the other hand, gives you the option of a targeted folder, app-only, or full system scan as well as other options.

It took TrustGo an average of 62.4 seconds to scan 238 apps and other assorted files while a dozen other apps were running.

 This latest version of TrustGo includes significant changes to the anti-malware engine, which caused the app to jump to the top of AV-Test’s January 2013 results with a perfect score. This independent testing lab also praised the additional features of the app, giving it a perfect usability score. PC Mag currently does not perform mobile malware detection evaluations in-house.

With TrustGo installed, there’s minimal impact on the user. The phone is still fast and responsive, even with a scan running. I didn’t notice any stuttering or lag playing Minecraft on my Samsung Galaxy Note II while TrustGo was scanning (even with 11 other apps running). With the TrustGo installed, it takes an average of 25.3 seconds to boot up the phone, and only another five seconds after that before the TrustGo logo appears on the top bar.

TrustGo can do SD card scanning and schedules weekly scans by default. I’d like to see scheduled scans made optional by default, however, since performance is critical with mobile devices.

Identifying and Removing Suspicious Apps
To see how TrustGo handled potentially malicious apps, I installed a penetration testing app that is frequently flagged as malware. After I installed the test app, TrustGo popped up a warning which I was pleased to note categorized it as a low threat, and also included information about the app. However, enough time had elapsed that I could have easily opened the suspicious app before TrustGo’s warning appeared.

After completing a scan with the penetration testing app on my device, TrustGo again correctly identified it as a potential threat and gave me the option ignore or delete it. This time I ignored the app, adding it to a list of ignored apps in the Settings menu.

Unfortunately, the rest of TrustGo didn’t quite get the message. I tried another scan, and it flagged the app again. This time I attempted to delete the app, which TrustGo failed to do. A third scan failed to turn up the app at all. After un-ignoring the app and running a scan, I successfully identified and deleted the app.

I had similar issues with other security suites in the past, and it disturbs me. Not only because TrustGo failed to perform its most basic function, but because it didn’t tell me that it failed to delete the app. The only way I recognized that something might have been up was that there was no uninstall confirmation screen. A less experienced user might easily believe that their phone was now safe and secure.

System Management
Similar to the Privacy Guard information, TrustGo pulls some of Android’s security-related settings and puts them in one easily accessible spot. From the System Management button, you can set limits on your mobile data, see your overall data consumption, and see how much data has been used by individual apps.

For those concerned about battery life, TrustGo also provides estimated durations for various activities. Tapping the lightning bolt button takes you to one of TrustGo’s more unusual sections, where it appears to be breaking down what percentage of your battery time each app is consuming. Presumably this battery information is an amalgamation of how much RAM and CPU time each app is consuming, however it’s poorly explained and one of the few times where TrustGo does a worse job than Android’s default system options. This could be a powerful (pun intended) feature with just a little more explanation.

Lastly, the Free Memory section shows a graph of how much RAM your device has available. Tapping the X to the right will shut down many of the apps, potentially freeing up more space for better performance. When I tapped the X it said 36 apps had been shut down but that might be a bit misleading because when I tapped it again it reported the same thing. These are all very useful features and TrustGo should be commended on making them easy to find and easy to manipulate. But that doesn’t change the fact that the developers are simply re-packaging what Android’s Settings app already does. While placing it in the context of a security app might foster better habits among users, it still feels like padding. If this app cost money, these features would seem ludicrous.

Backed Up to the Cloud
Google already stores a back up of your Android device’s settings, passwords, WiFi networks, and so on, but TrustGo can supplement that with a back up of your SMS messages, call log, and contacts. Backing up the information is a snap; it took me only 4.9 seconds to move the measly 304kb of data onto TrustGo’s system.

You can also back up or restore information to your device from TrustGo’s web portal. However, I found I was unable to restore my phone after having wiped it with TrustGo’s anti-theft tools. After resetting my phone, I was still unable to restore all of my information.

Browsing Securely
Like Kaspersky Mobile Security, TrustGo has a secure browsing feature that the company claims can keep you safe while you cruise the web. Unfortunately, it only works with your default Android browser, which on the Samsung Note II is the built-in Internet app

In my test, I found little impact on load times for websites. Running the Acid 3 test to 100 took an average of 3.36 seconds, which was not demonstrably longer than loading the page without TrustGo’s security.

Anti-Theft Troubles
Without question, the biggest single risk to your device and its data is simple theft. Like many security apps, TrustGo offers several anti-theft features accessible from a web portal. From here, you can track your device’s location, lock it, activate an alarm, or wipe its memory. Unfortunately, TrustGo does not feature the ability to activate the device’s camera remotely in order to catch a glimpse of whoever is using it like Kaspersky Mobile Security does. This is a shame, since it’s information that could eventually be used to file charges against a would-be thief.

Unlike other security apps, you can un-do many of these options remotely as well. In my testing, I found that I was able to quickly activate a remote lock and the alarm options, as well as undo them within seconds.

When all else fails, the Web portal allows you to delete any combination of your device’s SMS history, call logs, contacts, and accounts. You can also choose a factory reset, which will perform the above actions by default. You can also remotely wipe your SD card.

TrustGo even makes it simple to remove your device from their web service as well as purge all the data relating to your device. For those concerned about their data hanging around on company servers, this is a welcome addition.

While the Web portal works quite well, some of these anti-theft options are poorly implemented on the device. For example, while the alarm is piercingly loud and annoying, it can be dampened simply by plugging in headphones. Also, when you remotely request the device’s location, the GPS icon on the phone flashes.

Far more disconcerting was that I was easily able to circumvent the TrustGo screen which appears after the device is remotely locked. It requires no trickery: simply tap the home button and you’re at the homescreen. You can also press and hold the home button to see all the apps currently running on the device, and even close running apps. You can pull down from the top of the screen and access the Notification Center, as well as GPS, WiFi, and other options.

I found that you can activate apps on the homescreen even when the device has no lockscreen passcode but is locked by TrustGo. This was true for the Samsung Note II, Galaxy S III, and Nexus 7 tablet.

Admittedly, the TrustGo lockscreen re-appears as soon as the device goes to sleep or if you attempt to tap on an app. Also, though the TrustGo lockscreen isn’t secure, locking your device with a passcode would keep out any attackers. However, many people don’t use lockscreen passcodes and TrustGo’s not delivering with this feature.

It’s already been demonstrated that an attacker can do quite a bit of damage with just seconds of access to the homescreen, and while I was not able to deactivate TrustGo it strikes me as extremely problematic.

Trusting TrustGo?
TrustGo’s price is unbeatable, and its leap to the top of the malware detection heap is an enormous accomplishment. It rounds out its features with system management options and handy metrics which, though duplicating what Android itself offers, is convenient and easy to use—especially for new Android users.

I was prepared to give TrustGo at least three and a half stars based on its performance in independent labs and its dead-simple interface. However, the problems I experienced attempting to delete apps and the behavior of the device while locked remotely mean that I cannot recommend it as a stand-alone security option.

If you need a low-cost way to perform scans of your device, TrustGo has your back. But personally, I do not feel like I can trust TrustGo to do much else.

Specifications
Type Personal
Free Yes

Verdict
TrustGo brings top-rated malware protection at an unbeatable price, but its anti-theft options don't seem secure at all.
Published under license from Ziff Davis, Inc., New York, All rights reserved.
Copyright © 2012 Ziff Davis, Inc