Smartphone Security Shootout

Network Computing Dark Reading

Advertise

About Us

Threaded | Newest First | Oldest First

[close this box]

andregironda,
User Rank: Strategist
4/24/2015 | 3:37:17 PM

iOS just as vulnerable as Android

In the right context (or not) iOS is just as vulnerable as Android. Both are more vulnerable than BlackBerry ever was, but that's not relevant today.

What we must do is provide stringent review of all factors -- jailed or jailbroken devices, rooted or not, factory image or not, fully upgraded or not, etc.

Have seen major issues (severely critical risks) on jailed iOS 8.3 devices. Have seen minor (informational risk only events) on Android with a certain app ecosystem and a certain policy level of SELinux and/or SEAndroid. It depends on many factors.

JavierF126,
User Rank: Apprentice
4/24/2015 | 9:02:17 PM

Android

I completely DISAGREE with the author. By far iOS is the worst and most unsecure phone device, with plenty of bugs and also possible to inject whatever application to monitor all chats, location, etc WITHOUT jailbreak. Moreover Snowden, told public that it has a NSA Backdoor. Then, windowsphone sends all what you type to microsoft. Better is ANDROID nowadays.

Joe Stanganelli,
User Rank: Ninja
4/26/2015 | 11:50:01 PM

Re: Android

iOS certainly tops Android when it comes to security bugs and vulnerabilities found, but, still, a reported 96 percent of all mobile malware targets Android -- particularly because of how easy it is to do so (although do-badders are starting to find ways around Apple's iron-gated App Store with phishing techniques).

What it really comes down to, I think, is fostering a good security culture -- which is much more important than platform decision.

macker490,
User Rank: Ninja
4/30/2015 | 7:33:41 AM

Re: platform selection

Joe,--

to a point I think you are right: better user training will help. but you are tackling a blizzard with a push-broom: the rapacious raiding of user computers for "big data" by the commercial sector -- and by government -- is simply stunning.

run NOSCRIPT on your browser for a while and note: when you access a site -- like this one -- how many connections do you actually acquire?    the crux of this is that reading the internet is like running down a dark alley: wear your boots; don't go barefoot.

extending this to "platform" -- or your hardware/software setup -- security needs to be addressed starting from the standpoint of the operating software.   your operating software must not allow itself to be affected by the actions of an application program -- whether by intent or by error.

but o/s security is only a start

in our online environment all of our usual identifiers -- name, address, date of birth, social security number, eMail address, mother's maiden name, ... are all compromised -- either in public bazarrs or out in the DarkNet

Which leads us to the need for Secure Computing in a Compromised Environment

the basic need is an identification that can be used in public but which at the same time can be controlled by the owner

Symmetric keys -- such as eMial address, Soc.Sec.Nr &c are not sufficient: once compromised -- they can be used by anyone.   we must move to Public Key Encryption to provide the AUTHENTICATION of documents that is critical to business requirements.

to do this we must begin by dispelling the MYTH that PGP or GmuPG -- is too difficult for "everyone" to use. Properly packaged -- such as the ENIGMAIL plugin for Thunderbird -- anyone who can use Excel -- can easily use PGP/GnuPG

it's just another drop-down dialog box.

Joe Stanganelli,
User Rank: Ninja
4/30/2015 | 11:02:56 PM

Re: platform selection

@macker: It's really lamentable how many people/organizations continue to rely on SSNs as a security metric/identifier. SSNs were originally intended to have more of a "username" function -- and now they are used as "passwords" (which is just silly for anything requiring more security than, say, a 1990s Geocities chat room).

RetiredUser,
User Rank: Ninja
4/26/2015 | 7:07:46 PM

No Commercial Solutions Are Secure

I believe that no commercial solutions are secure; that is, unless they allow you to close the holes yourself. I've used many phones, and after having to please family by having a phone I truly don't want and being forced to - shall we say - "adjust" the phone to my liking, I immediately felt better about using it. No connection to a store-front (all software direct downloaded, MD5 hash validated, GnuPG-checked, etc.) and, when needed, encrypted connections wirelessly. Sad - how little freedom the consumer has over hardware and software that everyone takes for granted, ubiquitous mainstays of everyday life and easy avenues to everything we own, and everyone we know, if we let them be.

And that's just for personal use. So, no, I don't recommend an iPhone, Android or any other smartphone at the workplace if you happen to work around sensitive data. For all the same reasons USB drives are unacceptable in some work environments, so should smartphones be - especially since most are miniature computers and pose far more a threat (whether used knowingly for the purpose or without the owner's knowledge) to sensitive data integrity than USB drives ever could. By way of example, I found usernames and passwords online once that I only ever entered on one of my first smartphones years ago. That's right - never written down or used on a PC; and there, in a text file of usernames and passwords on a public website, found via a Google search, my private information.

Leave the smartphones at home, folks.

Joe Stanganelli,
User Rank: Ninja
4/26/2015 | 11:52:06 PM