Slashdot Mirror
Ask Slashdot: Most Secure Mobile OS?
Lexta writes "So I'm contemplating my next smartphone purchase, and I've been a little put off by all of the security exploits posted on Slashdot over the last few months, particularly for Android. So, what's the most secure stock standard (not jailbroken) mobile OS?"
Both Android and iOS have been plagued with exploits. Android has tons of trojans, while iOS has remote exploits (most of those iPhone jail breaking methods are based on remote root exploits). The only current smartphone OS that is safe against exploits and vulnerabilities is Windows Phone 7. Microsoft has really improved their security within the last 5 years - even on the desktop Windows most exploits are against third party apps like Flash or Java, not Windows itself.
So, if you want to get a smartphone that is safe against exploits and malware, Windows Phone 7 is your only answer. I would suggest some of the Nokia phones - people have been really happy with them.
We need a way to moderate articles.
Thousands of years and it's never been broken.
RIM's OS, especially due to the way they handle communications, is by far (as far as I know) the most secure OS. And neither iOS nor Android look particularly secure to me, since every other week you see some news of them getting exploited.
http://www.schneier.com/blog/archives/2012/03/nsas_secure_and.html
Security is something that people who need or want it, will have to pay for.
Most people do not care.
Normally I'd otherwise shit all over symbian, but, why not Symbian? Years on the market, it should've been proven one way or the other by now.
Also, what level of paranoia are we talking? State or industry secrets? Personal paranoia?
Non impediti ratione cogitationus.
The BlackBerry J2ME OS is by far the most secure OS out right now in terms of e-mail, for the simple fact that it tunnels corporate e-mail through its NOC and that is encrypted with triple DES the entire way. As far as handhelds go, I see about 1000 BlackBerry's a week in the course of work, and I've never seen a BlackBerry virus. Although doing some hardening testing with Windows Phone 7, I can say I am generally very impressed with it as well as the active-sync client.
If it is not jailbroken it is DEFINITELY not secure. With carrier spyware and apps that are not under your control, the first step to security is making it YOURS and yours alone.
Once you are to that point, then you can BEGIN evaluating the core OS for security.
Digital is, by definition, imperfect. Analog is the way to go.
What is your threat model? Do you use it for websurfing? Download lots of kewl apps? For the latter, from which app store?
I suspect that iOS is a bit more vulnerable on the web browser side, as android has a fair bit better sandboxing which means an exploit of the browser takes more work to fully p0wn the phone, while in iOS-land, 'p0wn the brower == p0wn the phone'
But OTOH, Apple is a much better curator: with only the official App store, and with bad-actor app-developers and apps a rarity, the Apple App Store is very safe.
Android? Not so much. Even the official Google store seems to rely too much on the Android sandboxing to keep users safe (when users just say 'ok' to anything needing scary permissions), and other App Stores are a vile abomination.
Finally, anything that doesn't say "Nexus" on it should be considered end-of-lifed before you buy it. Apple patches things for a long time, so old vulnerabilites shouldn't worry their user base. But Android phones, since they are pretty much EOL'ed right from the start, often never receive critical browser and related security patches, security patches which, due to the open nature, can pretty much be reverse engineered by a competent exploit developer.
So, my ranking: Nexus Phone > (slightly) iPhone >>> generic "Android" phone
Test your net with Netalyzr
Since they're true GNU/Linux platform...
There is no such thing as a secure mobile OS. They are all broken six ways from Sunday.
Security is a pattern of behavior as much as anything else. If you're serious about security and you need to use your phone for work, you need to use your phone only for work - never connect it to anything else, download any applications, visit any websites, etc.
If all you want is the ability to visit random websites and download random apps or games, do those things and don't use your phone to store or input sensitive information (e.g. logging into an online banking website or the email account you use for banking, storing passwords, etc.)
I mean, nobody here believes in security-through-obscurity any more do we? Windows phone and Blackbery, are perceived as secure, and are certainly security audited by their vendors. However, WebOS could actually be a lot less code to go through, and thus easier to audit than Android. Android has the disadvantage of being a target of opportunity, due to its commercial success. WebOS is basically dead, and there is no currently shipping hardware that is likely to keep shipping much longer, and no new devices planned. It's... a security-lovers dream platform. (Sarcasm only slightly intentional here.) Warren
I kind of have to agree with the Anonymous Commenter here; MeeGo is extremely fast, stable and easy to use, and so far everyone I know who has tried it has praised it. It also seems to have quite extensive security features. The issues are obviously that there's not as many applications available for it, none of the popular mobile games and so on, but that also is yet another layer of security too; it's simply too obscure an OS for it to be a lucrative target for hackers. You *CAN* install Android ICS on it, too, and dual-boot between Meego and ICS if you need something that Android has and Meego doesn't.
The thing is that you have to find somewhere to buy a Nokia N9, and they're not terribly easy to come by these days. But if you're looking for secure yet easy-to-use OS I'd say it's worth it.
Disclaimer: I do not own an N9 nor do I own any other device that runs Meego, so I cannot help with any specifics.
If you're really that bothered, maybe go for a phone that does phone calls, texting and some light web browsing with very little scope for crapware to get on board?
"I bless every day that I continue to live, for every day is pure profit."
There was a time when the most secure (consumer) desktop OS was the Mac -- because there were so few in service that the bad guys spent all their time and effort on Windows. By that measure, the most secure mobile environment is Windows Phone 7.
Pass that this way.... Bah nevermind..... In other news my Mac is bullet proof!! /sarcasm off .. Every OS is penetrable, hell even the flying drones are getting viruses. As an aside, every smartphone on the market is tracking what you do and who you talk to, and blah blah blah no matter what OS it runs. Google's is by far the worst, but your beloved iPhone is doing the same thing.
http://www.zdnet.com/blog/security/us-government-pays-250000-for-ios-exploit/11044
Contrast that to Android where two taps can turn one's phone into a spam machine, not to mention slurp up every single byte and hand it to an overseas organization.
I know this is a flamebait, I just wish to point out that the actual truth is far from what the AC here tries to portray; the most common method for Android phones to misbehave and people getting large bills is through the 'free' applications and games available on Android Market that send SMS-messages to premium numbers behind the user's back or similar stuff. That is no inherent fault of the Android OS itself, it's about how shoddy job Google does in regards with keeping the Android Market safe and clean. The remedy is simple though: don't install everything that is 'free', read a few reviews first, and check if there is something weird about the permissions that the application/game requests; there was for example a live wallpaper there just a while ago that requested the permission to open data connections, send SMS messages, read/write browser history and contacts list.. Obviously when a god damn wallpaper asks for such permissions there is something screwy going on.
That said, Google *really* must step up the game and do something. This kind of stuff is ridiculous.
A corporate-based phone (Blackberry) is going to make corporate security more of a priority than usability
I haven't noticed any problems with usability. Quite the opposite, in fact.
Security doesn't "get in the way" at all on the platform.
Required reading for internet skeptics
People throw around the term 'secure' all the time ... what does that mean in this instance?
Does the OS keep apps away from data they shouldn't have access to? Does its browser have the best track-record on drive-by's etc.? Does it mean it has/hasn't been exploited in the wild or not (e.g. Safari is riddled with security problems, but how often is it pwned in the wild?)? Do you want to be able to click links wildly and not get infected (and unicorns and rainbows)? Good security policies and enforcement of them? Criteria for/review of apps in the mobile stores/markets?
So ... what does secure mean for you? Define that and then try ask slashdot again later.
Que Deus te de em dobro o que me desejas
[May God give you double that which you wish for me]
They're all pretty close in terms on security features so it comes down to the one that's updated the quickest.
ayottesoftware.com
SYMBIAN
The old Blackberry OS (up to the latest, 7.1 coming out soon) has yet to be rooted or exploited. And the PlayBook qnx OS (completely different from the BBOS) had that dingleberry exploit a few months ago, but it too has since been plugged.
The number of exploits found in each mobile OS seem to be proportionate to that OS's market share. Note that found is the key word here. For the same reason that hackers prefer to find exploits for Windows instead of Mac, more holes are found and exploited in Android and iOS than in WP7 and Bada. It doesn't necessarily mean that WP7 and Bada have less holes, it's just that it's not (yet) worth anybody's effort to find them.
But if security really is the submitter's #1 factor for picking a smartphone (which seems a little far fetched), then I guess I'd recommend Bada. Good luck with that.
But TBH, I think the best way to stay safe regardless of which phone you own is to avoid dodgy apps and dodgy websites. Use common sense and you'll be fine with whatever phone you choose.
Slashdot: come for the pedantry, stay for the condescension.
iOS has yet to have a breach in the wild. There is the PDF exploit in the past, but that has yet to be used for anything other than a jailbreak
Oh, so it's merely a remote arbitrary code execution exploit? and it was actually used "in the wild"?
By the way, how do you know that it was never used for anything other than a jailbreak? Supposing someone would have used it to write an iOS exploit; how would the user of the infected phone know?
I'm not sure if this is available in the States, but Samsung's Bada would probably be one of the most secure mobile OS at the moment. There are no exploits out in the wild and no way to root it unless you actually flash the firmware.
More information on security is available via this developer link.
What? Use your brain?
That's crazy talk!
Faster! Faster! Faster would be better!
Since TFS was probably submitted by someone in the US, we can only reluctantly recommend the phone he is not allowed to have. Nokia decided not to embarrass their Lumia models in the USA, UK, Japan, Germany by releasing the N9 in competition.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
Yeah, like you're going to get an objective answer here. Slashdot doesn't have experts. It has OS bigots.
That being said, the most secure mobile OS is the one on the phone operated by someone who doesn't install ad-supported "free" apps, who password-protects the phone, doesn't load pirated software, and who enables remote wipe/locate-my-phone functionality.
Everybody gets what the majority deserves.
http://www.engadget.com/2012/03/01/nsa-builds-own-model-of-android-phone-wants-you-to-do-the-same/
Okay, so it's only off-the-shelf parts, but if you really want a mobile device that can earn the label "secure," (software ain't a thing w/o hardware) you're probably going to want something vetted by a security organization/company like....well...the NSA.
coding is life
Maemo / Meego Harmattan. Period. Full Stop.
* Carthago Delenda Est *
WebOS is ok. The only exploit I recall is the SMS exploit that hit everyone else too. They were quick to fix it. It's linux, so you can easily write your own iptables rules, disble services, etc. No jailbreak required for this. It's an open platform by design, and HP/Palm supported its community rather than try to lock them out.
The more complex the OS, the more chance for exploits. The simpler the OS, the less chance for things to go wrong, and if they do, the less chance for whatever is doing it to get anything useful. Granted there are some really awful 'simple' phones out there, but in terms of running trojans you're not going to get much going on your very basic cheap and nasty non-smart phone in the way of malware if all it does is make phone calls and send text messages (and doesn't have MIDP).
Almost all security comes down to social engineering. Any smart phone is open to attacks, and the primary attack path will generally be through the user. Don't install questionable apps. Don't visit unsafe websites; AFAIK, no mobile OSes are currently open to driveby attacks, but they have been in the past. (iOS in particular used to be; that was the basis of a way to jailbreak the iPhone.) Be alert to phishing and other types of trickery. Apply all relevant updates. Odds are, if you ever do get compromised, it will be because of something you did, not something inherent in the security - or lack thereof - of your device.
Was in James Cameron's pocket when he was 7 miles under the ocean.
"If any question why we died, Tell them because our fathers lied."
"put off by all of the security exploits posted on Slashdot over the last few months, particularly for Android" Funny you should single out Android because IOS has also had plenty of exploits and security holes despite (or maybe because of) Apple's walled-garden approach to software development, vetting, etc. I know this for a fact...I wrote a research paper on it.
Have you ever seen what the apple forums mods do when you post about getting a virus on a mac? They delete the post and ban your account. A few years back when mac's started getting viruses in the wild that was the exact response they took to every post, holding the "mac's don't get viruses" lie that so many still like to claim. This action has still been taken against people who post about them on the iPhone (they did it to people who asked about CarrierIQ as well, something confirmed to be in each iPhone made, and apple was the last to remove it - So by your argument, iPhones came pre-compromised for a longer period)
Basically, you don't hear about it on mac forums because they control the comments and prevent you from hearing about it. Cutting out the tongues of those bitching doesn't fix the problem they were bitching about, just makes them silent.
Also, there have been bad apps caught in the iTunes market on more than one occasion, and the PDF exploit that was used for jail breaking was also in the wild, but the people who used it to jailbreak never got infected via it because the jailbreakme site patched the exploit on those who jail broke. Stop apple astroturfing and pay attention to the reality of the phone market.
Silencing the people with issues doesn't fix the issues they have but it does a good job keeping the sheep happy.
its also not really all that secure.
I use it to SSH to my systems and I browse the web using Lynx. Bandwidth efficient and secure. Even the default Maemo from Nokia is more secure than most of the Android derivatives. I am not going to use an Android phone if I SSH to my servers anytime. Never failed me security-wise and I think it never will.
GM
It's far better than the alternatives, and has a proven track-record. It's also the only brand that consistently achieves the highest level of FIPS certification (on both phones and tablets) to say nothing of other security related certifications.
The question here is about the most secure mobile phone. BlackBerry is, without question, the answer.
My post was about usability vs. security. I was asserting that, from my experience, the legendary security that RIM provides does not hinder usability.
Required reading for internet skeptics
The N900 and N9 are full blown Unix/Linux machines with all the bells and whistles that come with a non-neutered version of the GNU/Linux environment.
That being said, they support many Unix/Linux security mechanisms, but if you want proof, how about full disk encryption for starters?
jdb2
If you are going to make a decision based on the number of public exploits, then you probably should choose the most proprietary system you can find, where the bug report database is hidden from view.
Good luck with your security through obscurity, you'll need it.
Agreed, I am using a bold 9700 with OS 5, everything integrates nicely, I can upload a picture to anything that may accept a picture from the camera right after taking, or from the image browser or from the filesystem browser. Third party apps can be installed from the browser without need of a PC, just about everything except OS upgrades can be done on the phone with no computer attached, and the real keyboard means actual content can by typed in, unlike touchscreen keyboards which can only strive to suck less
Snowden and Manning are heroes.
The most secure OS for a mobile device is clearly the Campbell's Soup OS.
Get 2 empty soup cans, and tie a string between them.
Look, it can even run "multithreaded" apps!
--Joe
And just to show once again that there's no reason to single out Android among the other mobile platforms for security vulnerabilities, this slashdot article about an IPhone crack was released just one day later. http://apple.slashdot.org/story/12/03/27/212254/cops-can-crack-an-iphone-in-under-two-minutes
I hear this custom Android build is pretty secure, if you can get your hands on it of course.
Caveat Emptor is not a business model.
SymbianS60/SymbianQT TPM system from ground up, buffer overflow is eliminated by design. Capability based security, critical capabilites can not be granted by end user, just OEM, and platform.