Sophos tries to install AD apps

Hi Woomera 

Can you please let us know if the device you are using is managed by Sophos Mobile Control? Also, which applications are you requested to install? Can you please post a screenshot?

Im on OOS 9.0.4 OnePlus 6. I found out that Sophos is trying to install the APk files which it has scanned even if I have not tried to install them. It is a strange issue and I have recorded it in action:

https://drive.google.com/open?id=1COLqj-n9ubSK8G_RkcXCMQXmKsikPMG5

as you can see I just copied a file inside Solid Explorer and after some time new screen pops up trying to install that APK and it is in use by Sophos.

Hi Woomera 

I am not able to access the file from Google Drive. Can try inserting the video in your post or PM me the video? Also, just wanted to confirm, is your device managed by Sophos Mobile Control? 

File size exceeds the limit, fixed the link sharing in GDrive and here is a Youtube link:

https://youtu.be/IYykMl5mQiU

"is your device managed by Sophos Mobile Control?" I'm not sure what you mean by that. I just installed the Sophos security app and gave it all the permissions it requested.

File size exceeds the limit, fixed the link sharing in GDrive and here is a Youtube link:

https://youtu.be/IYykMl5mQiU

"is your device managed by Sophos Mobile Control?" I'm not sure what you mean by that. I just installed the Sophos security app and gave it all the permissions it requested.

Hi Woomera 

Thank you for the video! Sophos Mobile Control is our EMM solution and it seems that you are not using Sophos mobile and have only installed Sophos Mobile Security from Google Playstore. From the video it seems that there is an app installation triggered which Sophos is blocking (As stated in the Sophos Pop up windows- "For your security, your phone is not allowed to install unknown apps from this source.") as it is not from a trusted source. It seems that Sophos Mobile Security is doing its job by blocking that installation. So, are you trying to install an APK file which Sophos is blocking or are you facing some other issue?

No, That is not what is happening. It is clear in the video, Sophos is taking the initiative on installing the APK without me ever asking for it to do so.

I just copied an APK between two folders and without clicking on it Sophos tries to install it afterward and it is asking for my permission to allow it.

Hi Woomera 

Upon copying the files, I can see that app installation is triggered. It seems that Sophos is not triggering the APK installation (just to block the installation in a few seconds? it does not make sense to me) as we can clearly make out from the alert message that it has blocked the application. If you still think Sophos is initiating the installation, I would request you to provide more evidence in this regards. It seems something else is triggering this and Sophos is blocking it. A few questions here: 

1. Does this happen only when you are copying that file to that folder? Is the issue reproducible on demand? If so, how? 

2. Run a full scan from Sophos Mobile Security and check if anything is found in the scan. 

3. If you still suspect Sophos is the culprit here, then try uninstalling Sophos (if you are comfortable doing this) and make sure installations from unknown sources is blocked in the settings, and reproduce the issue. 

Your response (A member of Sophos support team), just caused me to lose confidence is SOPHOS completely.

Let me be clear to anyone whom might read this in the future, The claim made by this support member of Sophos team, "an app installation triggered which Sophos is blocking", Is completely FALSE!

It is not Sophos app which is blocking the installation of the app but The OS is preventing the installation request FROM Sophos!

Android OS receives the installation request from Sophos security app and blocks it and then provides the user with a notification allowing the user to choose whether they want to allow this request.

It is clear that Sophos app is making this request by mistake after scanning the file.

Just by repeating the same claim over and over again it will not make it true!

I am not interested in continuing this conversation with you since it is clear it will not yield any result and will simply uninstall this flawed app.

Hi Woomera 

Apologies, but my previous response was solely based on the video which you have uploaded. It would be great if you can provide me your findings by going through the suggestions I have made in my previous post. If you need any further clarifications/assistance, you can PM anytime and I will be more than happy to help you out. 

Hello Woomera,

Just by repeating the same claim over and over again it will not make it true!
You're right. That Android OS receives the installation request from Sophos security app and The OS is preventing the installation request and that the popup around 0:32 means: Hi, I'm the Sophos app and tried to install some app but the OS is not permitting it is a quite ingenious interpretation of the episode shown in the video and quite a bold claim. All that's missing is that you allege that it was the Sophos app that downloaded all the Google Camera "ports" ...

Christian

Nothing in your video indicates it is anything at all initiated by Sophos Mobile Control. Considering you have a ton of APKs downloaded yourself you are either downloading them or have something running on your phone if you don't.

All your video has shown is that Mobile Security has blocked an unofficial app from being installed.

Firstly, you need to explain what is going on with your phone and why you have so many APKs.

The alternative to you doing this is an infected. Mobile Security app and the likelihood of that is incredibly low and if that were the case it would be incredibly helpful if you provided sensible and descriptive information due to the seriousness of the issue.

Otherwise, we have no idea what your problem is as it all looks like normal behaviour.

Emile