Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

4/24/2015
02:00 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Smartphone Security Shootout

Researcher compared Apple iOS, Android, Windows smartphones for business use privacy and security.

RSA CONFERENCE -- San Francisco -- Conventional wisdom would say Apple iPhone would be hands down more safe for business users than Android, but a security researcher found Android a close second to iPhone if it's a Google Nexus or Samsung Knox version phone.

Chet Wisniewski, senior security advisor at Sophos, here today released findings of his hands-on research on privacy and security implications of iOS, Android, and Windows smartphones for business users in his session "Mobile Security Shootout -- Which Smartphones Are Up to the Task?" "I would have no reservation using Apple iOS [for business] as long as you're going to use something to manage them and make a conscious decision on what goes on the phone," he said in an interview with Dark Reading last week prior to RSA.

"Android is mostly a thumbs up with a slight reservation: do you bring your own or choose it for the users? If you're going with Samsung Knox or Nexus, I have no reservations. They are on equal footing with iPhone," he says.

It's the BYOD Androids that are problematic. "If you have old Androids, or ones with seven layers of gunk on top, it becomes hard to know your risk profile," he says. "If I were an organization, I wouldn't look at BYO. You should choose your own [for users] then you can manage and restrict apps."

Wisniewski found the Windows phone a bit riskier for enterprises. "Until Windows 10 phone" comes out, he says, "I'd probably hold off on Windows myself."

That's because Windows 10 promises more control and improved API support, he says.

Wisniewski's smartphone experiment included three phones--all with their default settings: the Google Nexus 6 version 5.0.1; Apple iPhone 6+ iOS version 8.2; and Nokia Lumia 635 Windows 8.1.

"What surprised me was the increasing adoption of Windows Mobile among IT people. We're not seeing it deployed among thousands of employees, but seeing IT guys giving it to the IT staff," he says. "It's pretty darn good: it has an intuitive interface, the battery life is good, it's good quality, and more affordable than an iPhone. IT people like to try everything … I've enjoyed playing with it."

But he also found the Windows phone gathers the most user and phone information. "That's more sensitive for a business environment,"  he says.

He says he found it sends the phone user's keystrokes back to Microsoft for purposes of improving the keyboard software, or layout. But Wisniewski says while Microsoft isn't trying to grab passwords or anything nefarious, that information could accidentally get swept up in the reporting. "That was really disconcerting," he says. "I wouldn't want my potentially sensitive data sent off to a server and hoping Microsoft wouldn't lose it or whatever."

Another red flag was that the Windows phone encourages the use of the WiFi Sense feature, which collects logins from WiFi hotspots the user logs into and then automatically shares that information with friends, and logs onto open hotspots. "It sees a Starbucks connection on its own, accepts its licensing agreement, and connects you to it," he says. "If a friend of yours has a Windows phone, it will send your username and password and send them to your Comcast WiFi with their credentials."

The Android phone he tested leaks location information quite a bit, he says. "Apple doesn't without explicit permission," he says.

Wisniewski loaded apps on the phones that typical users might have for business as well as personal use: Facebook, Facebook Messenger, Pinterest, SnapChat, Twitter, a password managers and even Candy Crush Saga and a flashlight app.

Interestingly, the Flashlight app for iOS connected to 18 different networks within a minute after he fired up the app, and 14 ad networks. "It leaked my public and private IP addresses even though it wasn't given location permission. It grabbed my battery status, memory utilization … whether I was on WiFi or cellular, and the carrier that issued me my phone and sent that to the ad networks."

Battery status may not be sensitive information for a business user to have leaked, he says, but all of this data adds up. "All of this ad tracking does add up over time. It's a big data puzzle they put together. One app contacting 14 networks starts to build a profile I'm not comfortable with," he says.

The Android smartphone flashlight app, meanwhile, connected to 8 different ad networks. "It transmitted 7 megabytes of data in over one minute," he says.

The real difference among the security of smartphone platforms, he says, is the level of control the business has over them. "Separation [of business and personal data] is important … what processes do you allow on that device?" 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
andregironda
0%
100%
andregironda,
User Rank: Strategist
4/24/2015 | 3:37:17 PM
iOS just as vulnerable as Android
In the right context (or not) iOS is just as vulnerable as Android. Both are more vulnerable than BlackBerry ever was, but that's not relevant today.

What we must do is provide stringent review of all factors -- jailed or jailbroken devices, rooted or not, factory image or not, fully upgraded or not, etc.

Have seen major issues (severely critical risks) on jailed iOS 8.3 devices. Have seen minor (informational risk only events) on Android with a certain app ecosystem and a certain policy level of SELinux and/or SEAndroid. It depends on many factors.
JavierF126
0%
100%
JavierF126,
User Rank: Apprentice
4/24/2015 | 9:02:17 PM
Android
I completely DISAGREE with the author. By far iOS is the worst and most unsecure phone device, with plenty of bugs and also possible to inject whatever application to monitor all chats, location, etc WITHOUT jailbreak. Moreover Snowden, told public that it has a NSA Backdoor. Then, windowsphone sends all what you type to microsoft. Better is ANDROID nowadays.
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
4/26/2015 | 7:07:46 PM
No Commercial Solutions Are Secure
I believe that no commercial solutions are secure; that is, unless they allow you to close the holes yourself.  I've used many phones, and after having to please family by having a phone I truly don't want and being forced to - shall we say -  "adjust" the phone to my liking, I immediately felt better about using it.  No connection to a store-front (all software direct downloaded, MD5 hash validated, GnuPG-checked, etc.) and, when needed, encrypted connections wirelessly.  Sad - how little freedom the consumer has over hardware and software that everyone takes for granted, ubiquitous mainstays of everyday life and easy avenues to everything we own, and everyone we know, if we let them be.

And that's just for personal use.  So, no, I don't recommend an iPhone, Android or any other smartphone at the workplace if you happen to work around sensitive data.  For all the same reasons USB drives are unacceptable in some work environments, so should smartphones be - especially since most are miniature computers and pose far more a threat (whether used knowingly for the purpose or without the owner's knowledge) to sensitive data integrity than USB drives ever could.  By way of example, I found usernames and passwords online once that I only ever entered on one of my first smartphones years ago.  That's right - never written down or used on a PC; and there, in a text file of usernames and passwords on a public website, found via a Google search, my private information.

Leave the smartphones at home, folks.  
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
4/26/2015 | 11:50:01 PM
Re: Android
iOS certainly tops Android when it comes to security bugs and vulnerabilities found, but, still, a reported 96 percent of all mobile malware targets Android -- particularly because of how easy it is to do so (although do-badders are starting to find ways around Apple's iron-gated App Store with phishing techniques).

What it really comes down to, I think, is fostering a good security culture -- which is much more important than platform decision.
Joe Stanganelli
0%
100%
Joe Stanganelli,
User Rank: Ninja
4/26/2015 | 11:52:06 PM
Re: No Commercial Solutions Are Secure
It reminds me of the depressing thought that BlackBerry (for better or worse) used to be THE choice for security for mobile devices...until they gave in to foreign power demands to disable their security or provide government backdoors.
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
4/27/2015 | 1:09:43 AM
Re: No Commercial Solutions Are Secure
Wait, are you suggesting, Joe, that BlackBerry's slogan "There's good security and then there's National Security" and their marketing statement that BlackBerry is the "perfect balance of protection and productivity" hasn't reeled your confidence back in?!  Imagine, the company is now focused on mobile security software; amazing what a Department of Defense nod can do for your roadmap...
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/27/2015 | 9:01:52 AM
Samsung Knox
I was curious during its inception how the Samsung KNOX security suite would perform. Is it still enabled by default on Samsung based phones or was that removed due to user gripes? If its not set as default I guarantee that the majority of users will not turn it on even if prompted.
Blog Voyage
50%
50%
Blog Voyage,
User Rank: Strategist
4/28/2015 | 12:08:36 PM
Both are vulnerable !
In fact, iOS is just as vulnerable as Android. Both are more vulnerable than BlackBerry ever was, but that's not relevant today.
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
4/29/2015 | 11:24:04 PM
Re: No Commercial Solutions Are Secure
@Ian: After the Snowden revelations, would YOU trust a tech company on data privacy and data security if one of their biggest customers is the federal government?  ;)

(For that matter, should we continue to trust IBM?)  ;)
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
4/29/2015 | 11:26:23 PM
Re: Both are vulnerable !
Funny how older tech is often more secure.

Maybe we should go back to typewriters and smoke signals.
Page 1 / 2   >   >>
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
Chinese Attackers' Favorite Flaws Prove Global Threats, Research Shows
Kelly Sheridan, Staff Editor, Dark Reading,  10/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27652
PUBLISHED: 2020-10-29
Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
CVE-2020-27653
PUBLISHED: 2020-10-29
Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
CVE-2020-27654
PUBLISHED: 2020-10-29
Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.
CVE-2020-27655
PUBLISHED: 2020-10-29
Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.
CVE-2020-27656
PUBLISHED: 2020-10-29
Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.