Mobile Security trouve des riskware

db77

Bonjour,

Depuis une mise jour dont j'ai oublié la date mais qui remonte à belle lurette, j'ai une bonne dizaine d'applications qui sont détectées comme dangereuses par Mobile Security, toutes avec le même signalement "Riskware.Testkey.A", que ce soit sur mon téléphone ou sur celui de mon épouse.

Y a-t-il la possibilité de les mettre en liste blanche car je n'ai que le bouton "Désinstaller" ?

Merci.

Flexx

https://community.bitdefender.com/fr/discussion/96915/mobile-security-trouve-des-riskware

Android.Riskware.Testkey  is a riskware application that is detected by Bitdefender. Riskware is a type of software that can potentially harm your device or steal your personal information. It is not considered to be as dangerous as malware, but it is still important to remove it from your device.

I have had these detection for Android.Riskware.Testkey in the past. Seems out that this detection only appears if you have any modded version of android application installed on your device. No, other vendor detects any modded version as malicious. Earlier bitdefender also did not used to detect these modded version applications but recently it has started to and it seems to be pretty good thing.

@agozob can provide more information on this.

Also, you can contact the bitdefender support by visiting https://www.bitdefender.com/consumer/support/ and scroll down to the bottom of the webpage where you can get in touch with support representative either by email, chat or over a call.

Alternatively, you can also share your query with bitdefender mobile support team by dropping them an email at bms@bitdefender.com

The support team will reply back to your query within next 24-48 hours excluding weekends.

Regards

Alexandru_BD

Bonjour @db77,

Il n'existe pas d'option permettant de mettre sur liste blanche les applications détectées comme dangereuses par Bitdefender. Ces applications peuvent contenir des logiciels malveillants cachés, des logiciels publicitaires ou collecter des données sensibles.

Cordialment,

Alex

db77

Bonjour @Alexandru_BD et merci pour ta réponse.

Ce qui me "chagrine" c'est que cela soit arrivé d'un coup, après une mise à jour, à la fois sur le smartphone de mon épouse et le mien, et pour exactement le même soi-disant virus "Riskware.Testkey.A".

Nous n'avions, ni l'un ni l'autre, installé quoi que ce soit de spécial, et c'est apparu sur plusieurs applications.

Peut-être la politique du Play-Store qui aurait changé et du coup BitDefender appliquerait cette politique...

Bref, c'est gênant d'avoir ce message dès l'ouverture de Bitdefender.

Bonne fin de journée

PS : j'ai passé ESET, Avira, AVG, et aucun virus. Je devrais au moins avoir une de mes applis avec un virus parmi celles détectées par BitDefender.

Vu que les antivirus recherchent des chaines de caractères pour identifier des virus ou malwares, je suppose donc que BitDefender a un souci de chaine de caractères relative à "Riskware.Testkey.A", qu'il trouve dans plusieurs de mes applis et celles de ma femme. J'espère juste que cela sera corrigé.

db77

Voici par exemple une application officielle détectée par BMS, qui permet de dialoguer avec les montres connectées Huawei.

Croyez-vous que ce soit normal ?

Merci

Flexx

https://community.bitdefender.com/fr/discussion/comment/327757#Comment_327757

While I cannot comment for a specific application, the best way would be to send the sample to malware research team.

If you think the website/file is incorrectly blocked by bitdefender you can share the same with malware researchers by filling up the forum in below stated link

https://www.bitdefender.com/consumer/support/answer/29358/

If website/file is indeed incorrectly blocked, detection will be removed in maximum of 72 hours and if the detection still remains after 72 hours, consider the website/file as malicious by malware researchers and the detection will stay.

Regards

Alexandru_BD

Hello @db77,

I'll write my next comment in English, as I'm not a French speaker myself and I wish to avoid any misunderstanding that might occur when using a translator 🙂

Starting with the Mobile Security version 4.212.1113 on Android, a new detection type in Malware Scanner was added. Specifically, more recently we provide PUA detection on applications that are signed with public/leaked certificates, whose provenance cannot be verified. If multiple detections appeared suddenly, this happened as a result of the change that was applied in the product. If the apps are all legitimate and installed from the Play Store, it's unlikely for them to be signed with debug certificate. Either way, it's never a good sign if an app is flagged with a debug/leaked key. Concerning the whitelist part, the developers will explore this idea as I know the feature has been suggested before. Thank you for sharing the app example.

On legitimate stores it seems that this application is signed with verified Huawei certificate, however it looks like the app you have installed is a variant with a debug certificate. Perhaps it was manually installed at some point?

We appreciate if you can share more examples with us, so we can investigate these detections going forward.

Regards,

Alex