Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Smartphone Security Shootout
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
RetiredUser
RetiredUser,
 User Rank: Ninja
4/27/2015 | 1:09:43 AM
Re: No Commercial Solutions Are Secure
Wait, are you suggesting, Joe, that BlackBerry's slogan "There's good security and then there's National Security" and their marketing statement that BlackBerry is the "perfect balance of protection and productivity" hasn't reeled your confidence back in?!  Imagine, the company is now focused on mobile security software; amazing what a Department of Defense nod can do for your roadmap...
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
4/26/2015 | 11:52:06 PM
Re: No Commercial Solutions Are Secure
It reminds me of the depressing thought that BlackBerry (for better or worse) used to be THE choice for security for mobile devices...until they gave in to foreign power demands to disable their security or provide government backdoors.
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
4/26/2015 | 11:50:01 PM
Re: Android
iOS certainly tops Android when it comes to security bugs and vulnerabilities found, but, still, a reported 96 percent of all mobile malware targets Android -- particularly because of how easy it is to do so (although do-badders are starting to find ways around Apple's iron-gated App Store with phishing techniques).

What it really comes down to, I think, is fostering a good security culture -- which is much more important than platform decision.
RetiredUser
RetiredUser,
 User Rank: Ninja
4/26/2015 | 7:07:46 PM
No Commercial Solutions Are Secure
I believe that no commercial solutions are secure; that is, unless they allow you to close the holes yourself.  I've used many phones, and after having to please family by having a phone I truly don't want and being forced to - shall we say -  "adjust" the phone to my liking, I immediately felt better about using it.  No connection to a store-front (all software direct downloaded, MD5 hash validated, GnuPG-checked, etc.) and, when needed, encrypted connections wirelessly.  Sad - how little freedom the consumer has over hardware and software that everyone takes for granted, ubiquitous mainstays of everyday life and easy avenues to everything we own, and everyone we know, if we let them be.

And that's just for personal use.  So, no, I don't recommend an iPhone, Android or any other smartphone at the workplace if you happen to work around sensitive data.  For all the same reasons USB drives are unacceptable in some work environments, so should smartphones be - especially since most are miniature computers and pose far more a threat (whether used knowingly for the purpose or without the owner's knowledge) to sensitive data integrity than USB drives ever could.  By way of example, I found usernames and passwords online once that I only ever entered on one of my first smartphones years ago.  That's right - never written down or used on a PC; and there, in a text file of usernames and passwords on a public website, found via a Google search, my private information.

Leave the smartphones at home, folks.  
JavierF126
JavierF126,
 User Rank: Apprentice
4/24/2015 | 9:02:17 PM
Android
I completely DISAGREE with the author. By far iOS is the worst and most unsecure phone device, with plenty of bugs and also possible to inject whatever application to monitor all chats, location, etc WITHOUT jailbreak. Moreover Snowden, told public that it has a NSA Backdoor. Then, windowsphone sends all what you type to microsoft. Better is ANDROID nowadays.
andregironda
andregironda,
 User Rank: Strategist
4/24/2015 | 3:37:17 PM
iOS just as vulnerable as Android
In the right context (or not) iOS is just as vulnerable as Android. Both are more vulnerable than BlackBerry ever was, but that's not relevant today.

What we must do is provide stringent review of all factors -- jailed or jailbroken devices, rooted or not, factory image or not, fully upgraded or not, etc.

Have seen major issues (severely critical risks) on jailed iOS 8.3 devices. Have seen minor (informational risk only events) on Android with a certain app ecosystem and a certain policy level of SELinux and/or SEAndroid. It depends on many factors.
<<   <   Page 2 / 2


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type=&quot;text&quot;` via a javascript &quot;Show Password&quot; button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn&acirc;&euro;&trade;t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file