Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Smartphone Security Shootout
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
4/27/2015 | 1:09:43 AM
Re: No Commercial Solutions Are Secure
Wait, are you suggesting, Joe, that BlackBerry's slogan "There's good security and then there's National Security" and their marketing statement that BlackBerry is the "perfect balance of protection and productivity" hasn't reeled your confidence back in?!  Imagine, the company is now focused on mobile security software; amazing what a Department of Defense nod can do for your roadmap...
Joe Stanganelli
0%
100%
Joe Stanganelli,
User Rank: Ninja
4/26/2015 | 11:52:06 PM
Re: No Commercial Solutions Are Secure
It reminds me of the depressing thought that BlackBerry (for better or worse) used to be THE choice for security for mobile devices...until they gave in to foreign power demands to disable their security or provide government backdoors.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
4/26/2015 | 11:50:01 PM
Re: Android
iOS certainly tops Android when it comes to security bugs and vulnerabilities found, but, still, a reported 96 percent of all mobile malware targets Android -- particularly because of how easy it is to do so (although do-badders are starting to find ways around Apple's iron-gated App Store with phishing techniques).

What it really comes down to, I think, is fostering a good security culture -- which is much more important than platform decision.
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
4/26/2015 | 7:07:46 PM
No Commercial Solutions Are Secure
I believe that no commercial solutions are secure; that is, unless they allow you to close the holes yourself.  I've used many phones, and after having to please family by having a phone I truly don't want and being forced to - shall we say -  "adjust" the phone to my liking, I immediately felt better about using it.  No connection to a store-front (all software direct downloaded, MD5 hash validated, GnuPG-checked, etc.) and, when needed, encrypted connections wirelessly.  Sad - how little freedom the consumer has over hardware and software that everyone takes for granted, ubiquitous mainstays of everyday life and easy avenues to everything we own, and everyone we know, if we let them be.

And that's just for personal use.  So, no, I don't recommend an iPhone, Android or any other smartphone at the workplace if you happen to work around sensitive data.  For all the same reasons USB drives are unacceptable in some work environments, so should smartphones be - especially since most are miniature computers and pose far more a threat (whether used knowingly for the purpose or without the owner's knowledge) to sensitive data integrity than USB drives ever could.  By way of example, I found usernames and passwords online once that I only ever entered on one of my first smartphones years ago.  That's right - never written down or used on a PC; and there, in a text file of usernames and passwords on a public website, found via a Google search, my private information.

Leave the smartphones at home, folks.  
JavierF126
0%
100%
JavierF126,
User Rank: Apprentice
4/24/2015 | 9:02:17 PM
Android
I completely DISAGREE with the author. By far iOS is the worst and most unsecure phone device, with plenty of bugs and also possible to inject whatever application to monitor all chats, location, etc WITHOUT jailbreak. Moreover Snowden, told public that it has a NSA Backdoor. Then, windowsphone sends all what you type to microsoft. Better is ANDROID nowadays.
andregironda
0%
100%
andregironda,
User Rank: Strategist
4/24/2015 | 3:37:17 PM
iOS just as vulnerable as Android
In the right context (or not) iOS is just as vulnerable as Android. Both are more vulnerable than BlackBerry ever was, but that's not relevant today.

What we must do is provide stringent review of all factors -- jailed or jailbroken devices, rooted or not, factory image or not, fully upgraded or not, etc.

Have seen major issues (severely critical risks) on jailed iOS 8.3 devices. Have seen minor (informational risk only events) on Android with a certain app ecosystem and a certain policy level of SELinux and/or SEAndroid. It depends on many factors.
<<   <   Page 2 / 2


More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/12/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-36192
PUBLISHED: 2021-01-18
An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues (either marked as Private, or part of a private Project), if they are attached to an existing Changeset. The information is visible on the view.php p...
CVE-2020-36193
PUBLISHED: 2021-01-18
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
CVE-2020-7343
PUBLISHED: 2021-01-18
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.
CVE-2020-28476
PUBLISHED: 2021-01-18
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configura...
CVE-2020-28473
PUBLISHED: 2021-01-18
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with defa...