Your Smartphone Is Safer Than Your PC — For Now 125
snydeq writes "InfoWorld's Galen Gruman reports on the future of mobile security — one that will see a significant rise in exploits as valuable information increasingly migrates to mobile devices. To date, sandboxing and code-signing have helped make mobile OSes relatively secure, when compared with their desktop brethren. But as devices store more valuable information than email, they will become more enticing to hackers currently breaking into Windows PCs. And the biggest bulls-eye appears to be on Android, in large part because its architecture is most like that of the desktop PC but also because there are so many variants in use — too many for Google or the carriers to patch securely. And as the PDF-jailbreak vulnerability showed, sandboxing has its limits when it comes to securing the browser — the most likely point of entry for exploits not due to the rise of extensions, helper objects, and plug-ins on the mobile Web."
This is why I prefer my BB (Score:1, Interesting)
Re:Android less secure? (Score:3, Interesting)
I don't think it makes it more insecure so much as harder to close the holes. Handset vendors and carriers, for a long time, have worked with devices that generally could not be exploited in such a fashion, and probably don't have any means of getting such fixes out to their users within an acceptable time frame.
Re:This is why I prefer my BB (Score:3, Interesting)
The problem with all of this nonsense is that there seems to be the implicit
assumption that Windows is the yardstick. Windows is the single worst thing
out there. Even all of the other desktop OSen are much less of the problem.
Clearly the dividing line isn't "desktop OS' versus 'mobile OS'.
They are really more alike then they are different.
So it used to be "PCs are bad, flee to Macs and you will be safe".
Instead now it's "PCs are bad, flee to iPods and you will be safe".
Marketing (Score:4, Interesting)
Personally I think this is complete nonsense. Android runs on a lot of devices - soon to be added is the Toshiba AC100 netbook, so it will run on everything from entry level phones to small computers - which involves numerous changes in UI arising from optimisation and features. But the underlying architecture should make it possible to ensure that things are properly partitioned to give a robust security model, and Google isn't exactly short of brainpower. I suspect that just as we had the Microsoft trolls trying to minimise reports of Windows security issues, here we have Apple trolls trying to find narratives to attack Android.
And no, I don't use Android.
Re:Android less secure? (Score:4, Interesting)
Windows is a high value target, which was once crippled by it's backwards compatability with DOS and low skilled userbase. Microsoft, whatever their flaws, have some properly clever people and serious vested interest in addressing this problem, and they've finally put out a release that is fairly secure out of the box and somewhat usable - while still providing fairly timely security patches for a 10 year old release. Which is why the most serious threats are now coming from widely deployed software from less responsible companies (Adobe).
Android is the exact opposite. Very few smartphone manufacturers care enough to issue regular updates for their phones, especially once you get outside of the US market. Even on the US market, most smartphones have had exactly one update: from 1.5/1.6 to 2.0/2.1 usually. No monthly security updates, and nothing at all for obsolete phones over 12 months old. You'd better hope that nobody else has the time to look at your phone that your carrier has forgotten about.
Tech media has no clue about true security (Score:3, Interesting)
I keep hearing a lot of theories about security from the tech media like they know security. The problem is that security is a great way to scare up hits and freak people out so it's useful to write articles pandering in one direction or another, but there's rarely any true science to the articles, no figures, no statistics, no hard examples. This is because all that is boring and doesn't get hits, but it's what it takes to truly determine what is and what is not secure. Nothing is 100% secure, but then again we have this false sense of how architectures and security work. It's just BS.
This is the same kind of argument about how pundits spread the myth Macs are not any more secure than windows because hackers aren't targeting it. There's no evidence to back that statement up, and there's no evidence that Android less secure just because there are various flavors. In fact that can make it harder because one hack might not work on multiple flavors. That's even one of Androids problems now, that it's sometimes difficult to get a single app to work on multiple Android OS devices. You could then posit that the iPhone is easier to hack because the OS is so similar and the number of iOS devices in the wild is much higher than Android. But that's BS too because the iPhone is such a locked down system that in order to install anything you have to go thru the iTunes app store gatekeepers. The other way in is thru Safari, but that's really the only other way, and well now we know the security of Safari is BS because of that hole that they found in iOS 4 they used for jailbreaking. But compared to windows and compared to each other, which of these has had more critical vulnerabilities? The article gives me nothing.
Despite all this positing, it comes down to number of hacks, and what the hacks are. I could not truly begin to tell you which handhelds are more secure than others because no one, including this article, has any facts. The article eludes to "security circles" but who knows who those people are.
I think we should ban security articles from Slashdot unless they have a certain level of scientific statistics or hardcore evidence. Most articles about computer security on slashdot are not news for nerds, they are news for "platform fanboi weenies who want to start a flame war about which platform is more secure."
Re:it's almost like we did a complete reboot (Score:3, Interesting)
Re:Are variants a bad thing? (Score:2, Interesting)
"The wierd thing is, why can't Google pull an Apple? The iPhone gets updates from Apple, leaving out the carrier middleman, even if the user is paying a contract on the iPhone."
Partly because it isn't that easy - these things are often using custom drivers or require custom kernels to run. Yea, some of it is junk but much of it isn't. How are they going to update a bug in Motorola's GPS driver? Or even *why* would they? Lets face it if you had a custom bit of hardware that you had a linux driver on would like Ubuntu to push a new kernel to your device because it can? Nope, especially if that device was a core operational feature. It would be a nightmare to push an upgrade and break phones - it isn't like these upgrades are within the Dalvik VM - those apps can fairly safely be updated across everything, low level upgrades not so much.
If Android and the phone versions of Linux mature enough to have a true Open Source following we may get something like Linux is today. That is a lot of hard work by volunteers to make drivers for every major phone out there. Now some phones will still have restrictive boot loaders and such, but not all (and I will bet most) will not. It *can* happen but will require Android and it's linux underpinnings to stop it's rapid development and give volunteers time to get things in place - that isn't going to happen for some time. There is a devoted following right now making root exploits and custom roms - many times those custom roms are truly not wanted by the manufacturer but such is life in the open source world. When that happens we can run supported builds while under maintenance (or our carrier contract) and re-build with a Canonical build afterward :)
There *will* come some point where the technology matures enough that there just isn't that many updates. Compare development in the early 2.x tree of the Linux Kernel to how stable the current 2.6 tree is - heck compare just the 2.4 to the 2.6! At some point we will also not really feel the need to upgrade hardware either - PC manufacturers are hitting that and simply reducing quality so you have to re-buy nearly the same thing every few years. Further I think our phones are marching towards becoming our general purpose machines. As that happens the market will force some level of stability and customability on it too as people *can* realistically reverse engineer things and write an community driver for it.
Further it isn't even like Apple is immune to the issue - ask people with anything before a 3g how they like their current crop of updates with iOS 4 - chances are you are going to get some grumbling there. Then ask the iPhone 3 users who saw a significant slowdown after the update and you can see that even when you only have *one* hardware specification how hard it is to do. Even with the lockdown Apple has they can't do it to the point people want to make them out to have achieved - they only achieve that *if* you have compatible hardware which is true with Androids too. It's even arguable which is the larger group affected - only *some* older android users are whilst *all* older iPhone users are.
Ultimately the more freedom one has the more responsibility one has. This includes things like making sure you purchase upgradeable hardware and know how to do it. The more locked down a system is the less you have to worry with it but also the less you can deal with it when it occurs. Apple chose the latter route, Google chose the former. I think Google will win for a number of reasons - the above being one (Apple could win handily if they simply opened up the app store and ability to install unsigned software - but I do not think they will as long as Jobs is at the helm).
Re:it's almost like we did a complete reboot (Score:3, Interesting)