Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:00 PM
Connect Directly

Smartphone Security Shootout

Researcher compared Apple iOS, Android, Windows smartphones for business use privacy and security.

RSA CONFERENCE -- San Francisco -- Conventional wisdom would say Apple iPhone would be hands down more safe for business users than Android, but a security researcher found Android a close second to iPhone if it's a Google Nexus or Samsung Knox version phone.

Chet Wisniewski, senior security advisor at Sophos, here today released findings of his hands-on research on privacy and security implications of iOS, Android, and Windows smartphones for business users in his session "Mobile Security Shootout -- Which Smartphones Are Up to the Task?" "I would have no reservation using Apple iOS [for business] as long as you're going to use something to manage them and make a conscious decision on what goes on the phone," he said in an interview with Dark Reading last week prior to RSA.

"Android is mostly a thumbs up with a slight reservation: do you bring your own or choose it for the users? If you're going with Samsung Knox or Nexus, I have no reservations. They are on equal footing with iPhone," he says.

It's the BYOD Androids that are problematic. "If you have old Androids, or ones with seven layers of gunk on top, it becomes hard to know your risk profile," he says. "If I were an organization, I wouldn't look at BYO. You should choose your own [for users] then you can manage and restrict apps."

Wisniewski found the Windows phone a bit riskier for enterprises. "Until Windows 10 phone" comes out, he says, "I'd probably hold off on Windows myself."

That's because Windows 10 promises more control and improved API support, he says.

Wisniewski's smartphone experiment included three phones--all with their default settings: the Google Nexus 6 version 5.0.1; Apple iPhone 6+ iOS version 8.2; and Nokia Lumia 635 Windows 8.1.

"What surprised me was the increasing adoption of Windows Mobile among IT people. We're not seeing it deployed among thousands of employees, but seeing IT guys giving it to the IT staff," he says. "It's pretty darn good: it has an intuitive interface, the battery life is good, it's good quality, and more affordable than an iPhone. IT people like to try everything … I've enjoyed playing with it."

But he also found the Windows phone gathers the most user and phone information. "That's more sensitive for a business environment,"  he says.

He says he found it sends the phone user's keystrokes back to Microsoft for purposes of improving the keyboard software, or layout. But Wisniewski says while Microsoft isn't trying to grab passwords or anything nefarious, that information could accidentally get swept up in the reporting. "That was really disconcerting," he says. "I wouldn't want my potentially sensitive data sent off to a server and hoping Microsoft wouldn't lose it or whatever."

Another red flag was that the Windows phone encourages the use of the WiFi Sense feature, which collects logins from WiFi hotspots the user logs into and then automatically shares that information with friends, and logs onto open hotspots. "It sees a Starbucks connection on its own, accepts its licensing agreement, and connects you to it," he says. "If a friend of yours has a Windows phone, it will send your username and password and send them to your Comcast WiFi with their credentials."

The Android phone he tested leaks location information quite a bit, he says. "Apple doesn't without explicit permission," he says.

Wisniewski loaded apps on the phones that typical users might have for business as well as personal use: Facebook, Facebook Messenger, Pinterest, SnapChat, Twitter, a password managers and even Candy Crush Saga and a flashlight app.

Interestingly, the Flashlight app for iOS connected to 18 different networks within a minute after he fired up the app, and 14 ad networks. "It leaked my public and private IP addresses even though it wasn't given location permission. It grabbed my battery status, memory utilization … whether I was on WiFi or cellular, and the carrier that issued me my phone and sent that to the ad networks."

Battery status may not be sensitive information for a business user to have leaked, he says, but all of this data adds up. "All of this ad tracking does add up over time. It's a big data puzzle they put together. One app contacting 14 networks starts to build a profile I'm not comfortable with," he says.

The Android smartphone flashlight app, meanwhile, connected to 8 different ad networks. "It transmitted 7 megabytes of data in over one minute," he says.

The real difference among the security of smartphone platforms, he says, is the level of control the business has over them. "Separation [of business and personal data] is important … what processes do you allow on that device?" 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
User Rank: Ninja
4/27/2015 | 1:09:43 AM
Re: No Commercial Solutions Are Secure
Wait, are you suggesting, Joe, that BlackBerry's slogan "There's good security and then there's National Security" and their marketing statement that BlackBerry is the "perfect balance of protection and productivity" hasn't reeled your confidence back in?!  Imagine, the company is now focused on mobile security software; amazing what a Department of Defense nod can do for your roadmap...
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
4/26/2015 | 11:52:06 PM
Re: No Commercial Solutions Are Secure
It reminds me of the depressing thought that BlackBerry (for better or worse) used to be THE choice for security for mobile devices...until they gave in to foreign power demands to disable their security or provide government backdoors.
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
4/26/2015 | 11:50:01 PM
Re: Android
iOS certainly tops Android when it comes to security bugs and vulnerabilities found, but, still, a reported 96 percent of all mobile malware targets Android -- particularly because of how easy it is to do so (although do-badders are starting to find ways around Apple's iron-gated App Store with phishing techniques).

What it really comes down to, I think, is fostering a good security culture -- which is much more important than platform decision.
User Rank: Ninja
4/26/2015 | 7:07:46 PM
No Commercial Solutions Are Secure
I believe that no commercial solutions are secure; that is, unless they allow you to close the holes yourself.  I've used many phones, and after having to please family by having a phone I truly don't want and being forced to - shall we say -  "adjust" the phone to my liking, I immediately felt better about using it.  No connection to a store-front (all software direct downloaded, MD5 hash validated, GnuPG-checked, etc.) and, when needed, encrypted connections wirelessly.  Sad - how little freedom the consumer has over hardware and software that everyone takes for granted, ubiquitous mainstays of everyday life and easy avenues to everything we own, and everyone we know, if we let them be.

And that's just for personal use.  So, no, I don't recommend an iPhone, Android or any other smartphone at the workplace if you happen to work around sensitive data.  For all the same reasons USB drives are unacceptable in some work environments, so should smartphones be - especially since most are miniature computers and pose far more a threat (whether used knowingly for the purpose or without the owner's knowledge) to sensitive data integrity than USB drives ever could.  By way of example, I found usernames and passwords online once that I only ever entered on one of my first smartphones years ago.  That's right - never written down or used on a PC; and there, in a text file of usernames and passwords on a public website, found via a Google search, my private information.

Leave the smartphones at home, folks.  
User Rank: Apprentice
4/24/2015 | 9:02:17 PM
I completely DISAGREE with the author. By far iOS is the worst and most unsecure phone device, with plenty of bugs and also possible to inject whatever application to monitor all chats, location, etc WITHOUT jailbreak. Moreover Snowden, told public that it has a NSA Backdoor. Then, windowsphone sends all what you type to microsoft. Better is ANDROID nowadays.
User Rank: Strategist
4/24/2015 | 3:37:17 PM
iOS just as vulnerable as Android
In the right context (or not) iOS is just as vulnerable as Android. Both are more vulnerable than BlackBerry ever was, but that's not relevant today.

What we must do is provide stringent review of all factors -- jailed or jailbroken devices, rooted or not, factory image or not, fully upgraded or not, etc.

Have seen major issues (severely critical risks) on jailed iOS 8.3 devices. Have seen minor (informational risk only events) on Android with a certain app ecosystem and a certain policy level of SELinux and/or SEAndroid. It depends on many factors.
<<   <   Page 2 / 2
Where Are the 'Great Exits' in the Data Security Market?
Dave Cole, Cofounder and CEO, Open Raven,  10/13/2020
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-20
IBM Sterling B2B Integrator Standard Edition through and IBM Sterling File Gateway through are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...
PUBLISHED: 2020-10-20
IBM Spectrum Scale 5.0.0 through is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188517.
PUBLISHED: 2020-10-20
IBM Spectrum Scale 5.0.0 through does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link ...
PUBLISHED: 2020-10-20
IBM Spectrum Scale 5.0.0 through is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188595.
PUBLISHED: 2020-10-20
IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through could allow a local attacker to invoke a subset of ioctls on the device with invalid arguments that could crash the keneral and cause a denial of service. IBM X-For...