Slashdot Mirror
Your Smartphone Is Safer Than Your PC — For Now
snydeq writes "InfoWorld's Galen Gruman reports on the future of mobile security — one that will see a significant rise in exploits as valuable information increasingly migrates to mobile devices. To date, sandboxing and code-signing have helped make mobile OSes relatively secure, when compared with their desktop brethren. But as devices store more valuable information than email, they will become more enticing to hackers currently breaking into Windows PCs. And the biggest bulls-eye appears to be on Android, in large part because its architecture is most like that of the desktop PC but also because there are so many variants in use — too many for Google or the carriers to patch securely. And as the PDF-jailbreak vulnerability showed, sandboxing has its limits when it comes to securing the browser — the most likely point of entry for exploits not due to the rise of extensions, helper objects, and plug-ins on the mobile Web."
I don't need safety, my phone is magical!
Trolling is a art,
I have a stupid phone.
If you want safety and security - use a BlackBerry. Just ask India!
Please don't dominate the rap, Jack, if you got nothin' new to say.
.. over my iphone..and putting off getting an Android. The BB may be clunky, but I've a lot more confidence in it (so far) than iOS4/iPhoneOS 3.
So if an exploit occurs it will likely only affect some handsets as opposed to every handset.
Send it a .pdf and you can get root access aka jailbreaking it.
People have such a false sense of security about their smartphones right now that the first virus or truly inventive hack is going to have a frickin' field day. iPhone users are particularly cocky about how secure their phone is (and Apple isn't exactly a speed demon when it comes to security patches for their OS's either).
SJW: Someone who has run out of real oppression, and has to fake it.
Windows is an easy target because it's a huge badly-secured monoculture. How does having several different versions of Android to attack make it similarly insecure?
In my case, my desktop is safer than my PC. Even if i run linux in both (Ubuntu in my desktop, Maemo in my N900) the difference is more regarding physical security than logical one.
The only reason why this is true so far is that "the desktop" has been an unhealthy monoculture of a notoriously shoddy system, that couldn't, or when it could often as not wouldn't because "it wasn't a priority" sayeth the vendor, fix its problems at all, nevermind in a timely fashion. Widespread worst practices compounded the problem and equal developer unwillingness to address that compound the problem. I am quite happy this is much less the case in mobile computing, and for that reason alone we should keep multiple systems alive. Android, symbian, and so on. We need that diversity as much as we need open systems.
One might hope that now we know better, but whether we will do better is something else entirely. My guess is, we won't. It's been a long standing problem in the industry, commented years ago on by the late E.W. Dijkstra. And we have done little to nothing to fix it.
The PC was invented before the internet and the security model was set up to allow everyone to do almost anything
the smart phone was made for the internet and manufacturers seem to be locking them down. completely opposite of the PC
Personally I think this is complete nonsense. Android runs on a lot of devices - soon to be added is the Toshiba AC100 netbook, so it will run on everything from entry level phones to small computers - which involves numerous changes in UI arising from optimisation and features. But the underlying architecture should make it possible to ensure that things are properly partitioned to give a robust security model, and Google isn't exactly short of brainpower. I suspect that just as we had the Microsoft trolls trying to minimise reports of Windows security issues, here we have Apple trolls trying to find narratives to attack Android.
And no, I don't use Android.
From scarped cliff or quarried stone she cries "A thousand types are gone, I care for nothing, no not one."
Intel clearly sees this as a huge future market, and were willing to drop several billion to get a good place in it. Your phone doesnt have a security chip? You fucked.
Yes, if a large portion of those version are old, with known exploits, and unpatched...
Any less secure than other phones? Maybe not compared to some, though Apple is actually fairly "pushy" when it comes to the "there's a new update for your phone/itunes/whatever" thing.
What pisses me off is companies like Motorola. My phone has known bugs with known fixes, but since it's a Milestone and not a Droid, I can't upgrade the firmware myself, and they've yet to have an NA release date for Droid 2.2. Eventually, I'm sure they'll just abandon the phone and leave it un-patchable in favour of the newer model, Jerks.
My next phone will still likely be Android, but likely an HTC (or another brand that's not evil, no more moto for me).
I keep hearing a lot of theories about security from the tech media like they know security. The problem is that security is a great way to scare up hits and freak people out so it's useful to write articles pandering in one direction or another, but there's rarely any true science to the articles, no figures, no statistics, no hard examples. This is because all that is boring and doesn't get hits, but it's what it takes to truly determine what is and what is not secure. Nothing is 100% secure, but then again we have this false sense of how architectures and security work. It's just BS.
This is the same kind of argument about how pundits spread the myth Macs are not any more secure than windows because hackers aren't targeting it. There's no evidence to back that statement up, and there's no evidence that Android less secure just because there are various flavors. In fact that can make it harder because one hack might not work on multiple flavors. That's even one of Androids problems now, that it's sometimes difficult to get a single app to work on multiple Android OS devices. You could then posit that the iPhone is easier to hack because the OS is so similar and the number of iOS devices in the wild is much higher than Android. But that's BS too because the iPhone is such a locked down system that in order to install anything you have to go thru the iTunes app store gatekeepers. The other way in is thru Safari, but that's really the only other way, and well now we know the security of Safari is BS because of that hole that they found in iOS 4 they used for jailbreaking. But compared to windows and compared to each other, which of these has had more critical vulnerabilities? The article gives me nothing.
Despite all this positing, it comes down to number of hacks, and what the hacks are. I could not truly begin to tell you which handhelds are more secure than others because no one, including this article, has any facts. The article eludes to "security circles" but who knows who those people are.
I think we should ban security articles from Slashdot unless they have a certain level of scientific statistics or hardcore evidence. Most articles about computer security on slashdot are not news for nerds, they are news for "platform fanboi weenies who want to start a flame war about which platform is more secure."
"All great wisdom is contained in .signature files"
http://infoworld.com/print/135570 ... You're welcome! :)
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
It is kind of funny that one needed to resort to an iPhone bug to support an article talking about how Android is unsafe...
"And the biggest bulls-eye appears to be on Android, in large part because its architecture is most like that of the desktop PC"
This seems like a very dubious claim to me. From my perspective, iOS seems much more similar in architecture to the desktop than Android.
iOS apps are native compiled, written in dialect of a language that is famous for buffer overruns (C), and the userland is a modified version of a desktop operating system.
Android, while also based on a desktop OS (Linux) at the kernel level, has much of the application code (and all third party apps) running in a manage VM environment, which while not invulnerable, seems much less likely to fall victim to poor coding practices. The exceptions would be of course apps that embed native libraries (I'm guessing these are the exception, not the rule).
To me as well.
But not for this reason. Android has a lot in common with Linux desktops, far more then IOS has in common with OSX desktops but unlike OSX, Linux does not make serious security concessions for "Just Working".
But what will ultimately decide what platform will be targeted will be two factors. First the ease of finding an exploitable vulnerability, in this regard I'd say IOS is as vulnerable as Android, if not more so (meaning neither is particularly vulnerable) but the ratio of Jailbroken(rooted) to Vanila devices is far higher on IOS then Andriod because Jailbreaking is touted as a solution to lack of basic functionality.
So the deciding factor in all of this would be the number of devices, right now there are more IOS devices in the wild then Android devices. Further more the userbase of IOS tend to to understand computer security issues (hence Apple's "Just works" marketing) so it makes more sense to target IOS for now. Eventually Android will overtake IOS but as so many Iphone Fanboys like to point out, there are dozens of Android models and four major versions of Android running (1.6, 2.0, 2.1, 2.2) so IOS will remain a bigger target for some time.
Calling someone a "hater" only means you can not rationally rebut their argument.
My Smartphone is safer than most PCs because most PCs run Windows. Windows is designed so that all programs share a common registry. The problem in that lies in the fact that just about anything can modify that same registry.
I don't see my phone (Android) having that problem. The only thing I foresee happening realistically any time soon is by means of social engineering, as opposed to other methods.