Forgot your password?
typodupeerror
Security IT

Your Smartphone Is Safer Than Your PC — For Now 125

Posted by CmdrTaco
from the ominous-chords-go-here dept.
snydeq writes "InfoWorld's Galen Gruman reports on the future of mobile security — one that will see a significant rise in exploits as valuable information increasingly migrates to mobile devices. To date, sandboxing and code-signing have helped make mobile OSes relatively secure, when compared with their desktop brethren. But as devices store more valuable information than email, they will become more enticing to hackers currently breaking into Windows PCs. And the biggest bulls-eye appears to be on Android, in large part because its architecture is most like that of the desktop PC but also because there are so many variants in use — too many for Google or the carriers to patch securely. And as the PDF-jailbreak vulnerability showed, sandboxing has its limits when it comes to securing the browser — the most likely point of entry for exploits not due to the rise of extensions, helper objects, and plug-ins on the mobile Web."
This discussion has been archived. No new comments can be posted.

Your Smartphone Is Safer Than Your PC — For Now

Comments Filter:
  • by Anonymous Coward on Tuesday August 31, 2010 @03:26PM (#33428806)

    I have a stupid phone.

  • If you want safety and security - use a BlackBerry. Just ask India!
  • .. over my iphone..and putting off getting an Android. The BB may be clunky, but I've a lot more confidence in it (so far) than iOS4/iPhoneOS 3.
    • Like the article says, Android is becoming a big target these days and yet no one has found any significant exploits to its security model. Everything that I've read seems to think that it is as bulletproof as a modern, complex OS can be. That isn't to say that there won't be the occasional flaw but it is almost certainly orders of magnitude more secure than a certain piece of software that runs on a few billion computers around the world (including, I suspect, the majority of Slashdotters).

      • Re: (Score:3, Interesting)

        by jedidiah (1196)

        The problem with all of this nonsense is that there seems to be the implicit
        assumption that Windows is the yardstick. Windows is the single worst thing
        out there. Even all of the other desktop OSen are much less of the problem.

        Clearly the dividing line isn't "desktop OS' versus 'mobile OS'.

        They are really more alike then they are different.

        So it used to be "PCs are bad, flee to Macs and you will be safe".
        Instead now it's "PCs are bad, flee to iPods and you will be safe".

  • by DrXym (126579) on Tuesday August 31, 2010 @03:34PM (#33428906)
    And the biggest bulls-eye appears to be on Android, in large part because its architecture is most like that of the desktop PC but also because there are so many variants in use -- too many for Google or the carriers to patch securely.

    So if an exploit occurs it will likely only affect some handsets as opposed to every handset.

    • by John Hasler (414242) on Tuesday August 31, 2010 @03:56PM (#33429138) Homepage

      So if an exploit occurs it will likely only affect some [Android] handsets as opposed to every handset.

      But the scary news stories will omit that little detail.

    • Re: (Score:2, Flamebait)

      by node 3 (115640)

      And the biggest bulls-eye appears to be on Android, in large part because its architecture is most like that of the desktop PC but also because there are so many variants in use -- too many for Google or the carriers to patch securely.

      So if an exploit occurs it will likely only affect some handsets as opposed to every handset.

      And if a fix is created, it will only be applied to some handsets as opposed to every handset.

      • by 2names (531755)
        And if a fix is created, it will only be applied to some handsets as opposed to every handset.

        Well, DUH! That's because not every handset will need it.
        • by node 3 (115640)

          And if a fix is created, it will only be applied to some handsets as opposed to every handset.

          Well, DUH! That's because not every handset will need it.

          But not every handset that needs it will get it, which is the whole premise of this article.

    • by djdanlib (732853) on Tuesday August 31, 2010 @04:02PM (#33429214) Homepage

      So we'll all be depending on multiple carriers' good patching practices, to make sure the patch for foolib-1.2.3-r4 gets pushed to all their Frobnitz Model 200 phones that they released two years ago and have since deprecated and replaced with Model 201, 220, 240, and 250, now with more shiny (but everyone still gets them because they're free with a new contract.) And by the way, it's going to be on your data bill. Call me pessimistic, but I don't think it'll happen in a timely fashion when someone discovers a vulnerability.

      Crackers compete over who can own the most boxes just so they can have bragging rights. Oh look, such-and-such group disabled e911 for 20,000 people, why hasn't OUR group done that yet? We'd better do something even bigger so we can be elite again. Someone will find the loose rivet in the armor, and it'll be like a colonial land grab for a few months until the patch gets distributed.

      • by PitaBred (632671)

        Man, am I glad that I got a Nexus One. This kind of thing is the reason that Google pushed to get people to buy phones separate from the carriers. Too bad the carriers are too strong.

        • by CastrTroy (595695)
          The reason that people get phones from their carriers is that they get a discount on their phone when they buy it from the carrier and sign a contract. The problem is, is that you can't buy your own phone, and have a cheaper rate plan. The rate plan is the same price regardless of where your phone came from or whether or not you are on a contract. So you actually have to spend a lot more money to get a phone from someone other than your carrier.
        • by goarilla (908067)
          so you can do what ? build a cross platform compiler, patch the nexus one's source
          ( if you can get it), and be more secure (patchwise and services wise) than those
          'upstream carriers' ?

          unlimited access is nice for adding features or doing different things with them ... not
          so for locking down the (purpose-specific) system-util for better security on your OWN.
      • by mlts (1038732) *

        Most likely Google will throw the kill switch and the offending app gets purged from devices.

        Assuming the malware didn't get root access, of course. If the user does allow it through su, all bets are off.

      • by tlhIngan (30335) <.slashdot. .at. .worf.net.> on Tuesday August 31, 2010 @04:52PM (#33429790)

        So we'll all be depending on multiple carriers' good patching practices, to make sure the patch for foolib-1.2.3-r4 gets pushed to all their Frobnitz Model 200 phones that they released two years ago and have since deprecated and replaced with Model 201, 220, 240, and 250, now with more shiny (but everyone still gets them because they're free with a new contract.) And by the way, it's going to be on your data bill. Call me pessimistic, but I don't think it'll happen in a timely fashion when someone discovers a vulnerability.

        It's already happened on Android. Manufacturers are out making their latest rev and they ignore the bugfiles to their current line of phones. Or they do and pass it onto the carriers who may or may not force an update. Of course, if said update will remove things like root and custom ROMs, they'll probably push it.

        But phones getting abandoned at whatever Android version they shipped with are already happening - I think the early Samsung phones were promised 2.0, but ended up with 1.6 only with an official letter. And others are stuck with 2.1 with no upgrade to 2.2. The only good part is these phones often are early models and easy to root and recover, so unofficial ROMs exist. But later ones may not be so lucky.

        Really, the only Android phone that's not under carrier control is the Nexus One, which gets updates straight from Google. The wierd thing is, why can't Google pull an Apple? The iPhone gets updates from Apple, leaving out the carrier middleman, even if the user is paying a contract on the iPhone.

        Google's big enough, let's see it happen and end all this Android loaded with crapware stuff.

        • by Sancho (17056) * on Tuesday August 31, 2010 @05:15PM (#33430056) Homepage

          The wierd thing is, why can't Google pull an Apple? The iPhone gets updates from Apple, leaving out the carrier middleman, even if the user is paying a contract on the iPhone.

          Because Android is an open platform. The carriers take Android, mold it to fit their needs, and put it on their phones. Google, or rather the Open Handset Alliance, doesn't have any say on it. That's how carriers can get away with modifying the source of the Hotspot app to only work if the customer pays extra.

          This is the downside to GPLv2. The Tivoization loophole means that carriers can do this, release the source, and you still can't (necessarily) modify the source and put it on your phone.

          Google started taking steps to address some of this by moving more of their apps to the app store, but you still have issues with system libraries and the kernel. Without root, an app can't update these.

          • by ADRA (37398)

            Open handset or not, Google does make approvals for their platform which is the only way that their own 'proprietary' apps like market and maps get shipped to phones.

        • I wouldn't be surprised if this eventually leads to a decrease in customization/fragmentation/whatever you want to call it. Handset vendors insist on customizing the OS because they want to "differentiate themselves". So they stick on a custom UI, a bunch of their own apps, etc. But they're already discovering the downside to this: the more they customize, the more they're stuck maintaining themselves. Look how many phones don't even have Android 2.1 yet, much less 2.2. They're discovering that it take
        • Re: (Score:2, Interesting)

          by bm_luethke (253362)

          "The wierd thing is, why can't Google pull an Apple? The iPhone gets updates from Apple, leaving out the carrier middleman, even if the user is paying a contract on the iPhone."

          Partly because it isn't that easy - these things are often using custom drivers or require custom kernels to run. Yea, some of it is junk but much of it isn't. How are they going to update a bug in Motorola's GPS driver? Or even *why* would they? Lets face it if you had a custom bit of hardware that you had a linux driver on would li

  • by elrous0 (869638) * on Tuesday August 31, 2010 @03:35PM (#33428920)
    People have such a false sense of security about their smartphones right now that the first virus or truly inventive hack is going to have a frickin' field day. iPhone users are particularly cocky about how secure their phone is (and Apple isn't exactly a speed demon when it comes to security patches for their OS's either).
    • by node 3 (115640) on Tuesday August 31, 2010 @04:03PM (#33429232)

      People have been saying this about the Mac for a decade now, too. I'm glad I didn't hold my breath waiting for this supposed apocalyptic day of comeuppance...

      • by recoiledsnake (879048) on Tuesday August 31, 2010 @04:35PM (#33429626)

        The real reason is that malware authors cannot afford Macs :)

      • *cough* sure [iantivirus.com]*cough*
        Less threats, sure. But far from completely secure.
        • Re: (Score:1, Troll)

          by node 3 (115640)

          *cough* sure [iantivirus.com]*cough*

          Sounds like you're coming down with something there PC.

          Less threats, sure. But far from completely secure.

          Please quote where I said Macs are "completely secure".

          That list you linked to is bogus. There are no viruses for Mac OS X AT ALL. And there are only a handful of actual trojans/malware, none of which is widespread, and none of which is of the level of concern where a Mac user should feel compelled to run anti-virus/anti-malware software.

          If this is your idea of Mac's comeuppance, you're really stretching it.

      • by mjwx (966435)

        People have been saying this about the Mac for a decade now, too. I'm glad I didn't hold my breath waiting for this supposed apocalyptic day of comeuppance...

        I wish you held your breath waiting for the supposed day where there were enough Mac's to make that apocalyptic day viable.

      • Re: (Score:2, Insightful)

        by bm_luethke (253362)

        And it hasn't been because of some great security model either - there has been now for weeks an iOS exploit that if you open a correctly formed (or rather malformed) PDF it silently roots your phone and installs any software it wants on your phone. It has access to *everything*. You can not tell me that is "good security". The Mac isn't any better either.

        It hasn't been an issue for one of several reasons.

        One is that no one had taken advantage of it beyond jail breaking phones. One needs to think through th

  • by cyber-vandal (148830) on Tuesday August 31, 2010 @03:36PM (#33428928) Homepage

    Windows is an easy target because it's a huge badly-secured monoculture. How does having several different versions of Android to attack make it similarly insecure?

    • Re: (Score:3, Interesting)

      by Microlith (54737)

      I don't think it makes it more insecure so much as harder to close the holes. Handset vendors and carriers, for a long time, have worked with devices that generally could not be exploited in such a fashion, and probably don't have any means of getting such fixes out to their users within an acceptable time frame.

    • by jedidiah (1196)

      ...what I want to know are what are these similar mistakes that Android or PhoneOS is supposed to be making?

      HELL: what similar mistakes are Linux, Solaris, MacOS and FreeBSD supposed to be making?

      • by bsDaemon (87307) on Tuesday August 31, 2010 @03:52PM (#33429090)

        The mistake of letting users interact with them. Users are the number one security flaw in any system.

        • Re: (Score:3, Funny)

          by node 3 (115640)

          The mistake of letting users interact with them. Users are the number one security flaw in any system.

          Sure, a daemon would say that, wouldn't it?

          • by smolloy (1250188)

            Replying to undo incorrect moderation...

            • Re: (Score:1, Offtopic)

              by SleazyRidr (1563649)

              Usually when I mess up my moderation, I try to play it off by overusing some already overused /. meme.

              For instance, in this situation, I would have posted something along the lines of 'I, for one, welcome our security-flaw-noticing daemon overlords.'

        • by jgagnon (1663075)

          The root of the problem: people make really crappy users. Robots and animals are a far better choice.

        • Re: (Score:2, Insightful)

          by bit01 (644603)

          The mistake of letting users interact with them. Users are the number one security flaw in any system.

          No, this is a myth perpetuated by second-rate programmers and system administrators to cover up their own incompetence.

          The number one security flaw is incompetent programmers and administrators not designing their systems for their target audience.

          e.g. Putting executable content into documents by default when it is almost always not needed or wanted. It's not rocket science.

          ---

          Anonymous commercial speech

      • by mlts (1038732) *

        The "mistake" that non-Windows platforms make is the fact that developers on that platform actually value what they are developing on. There isn't any of that on Windows, and Windows devs feel free to crap where they sleep.

        Platform loyalty is important. Not many programmers on Windows would go out of their way to deal with the latest worm or Trojan (unless it fattened their wallets, of course), but on other platforms, almost everyone would ensure that it would be stopped. Mac devs don't like viruses (esp

        • by hedwards (940851)
          I suspect that part of the problem with Windows is that MS doesn't enforce the kind of cleanliness and neatness of code that some of the competitors do. Granted all OSes have some cruft and scariness in places, but most of the ones that are known for stability have long since shaped up and enforced something along the lines of style [freebsd.org] I'm sure that most modern projects of any size and reliability have something similar to work from. The more uniform the style is and the better the adherence the easier it is t
    • Marketing (Score:4, Interesting)

      by Kupfernigk (1190345) on Tuesday August 31, 2010 @04:01PM (#33429212)
      Apple is trying to attack Android, which is growing in marketshare much faster than the iPhone. So they are trying to encourage the view that a monoculture is a virtue, and the various flavours of Android are somehow fracturing the market. (One phone to rule them all...)

      Personally I think this is complete nonsense. Android runs on a lot of devices - soon to be added is the Toshiba AC100 netbook, so it will run on everything from entry level phones to small computers - which involves numerous changes in UI arising from optimisation and features. But the underlying architecture should make it possible to ensure that things are properly partitioned to give a robust security model, and Google isn't exactly short of brainpower. I suspect that just as we had the Microsoft trolls trying to minimise reports of Windows security issues, here we have Apple trolls trying to find narratives to attack Android.

      And no, I don't use Android.

      • by mlts (1038732) *

        Devil's (or more exactly Apple's) advocate here:

        From a QA perspective, having eight devices to have to test on (four iPhones, iPad, iPad 3G, two iPod Touch models) is a lot easier than checking to see if your device works with different displays, resolutions keyboards, trackballs (physical and virtual), status lights, cameras, and so on.

        One mistake on your Android app, and your app's review status starts going deep in a hole with tons of "Force closes on the Blarf, refunded." on the Marketplace review sheet

    • by Wiarumas (919682)
      Security through software proliferation?
      • by hedwards (940851)
        Not really, it increases the likelihood that a vulnerability will be found, but decreases the likelihood that the vulnerability will affect a large number of phones. I suspect that it's ultimately a wash. More possible holes but likely fewer devices that contain said holes to exploit.
    • by akadruid (606405) <slashdot@thedruid.co . u k> on Tuesday August 31, 2010 @04:40PM (#33429682) Homepage

      Windows is a high value target, which was once crippled by it's backwards compatability with DOS and low skilled userbase. Microsoft, whatever their flaws, have some properly clever people and serious vested interest in addressing this problem, and they've finally put out a release that is fairly secure out of the box and somewhat usable - while still providing fairly timely security patches for a 10 year old release. Which is why the most serious threats are now coming from widely deployed software from less responsible companies (Adobe).

      Android is the exact opposite. Very few smartphone manufacturers care enough to issue regular updates for their phones, especially once you get outside of the US market. Even on the US market, most smartphones have had exactly one update: from 1.5/1.6 to 2.0/2.1 usually. No monthly security updates, and nothing at all for obsolete phones over 12 months old. You'd better hope that nobody else has the time to look at your phone that your carrier has forgotten about.

      • "the most serious threats are now coming from widely deployed software from less responsible companies (Adobe)."

        FAR less responsible...

    • Yes, if a large portion of those version are old, with known exploits, and unpatched...
      Any less secure than other phones? Maybe not compared to some, though Apple is actually fairly "pushy" when it comes to the "there's a new update for your phone/itunes/whatever" thing.

      What pisses me off is companies like Motorola. My phone has known bugs with known fixes, but since it's a Milestone and not a Droid, I can't upgrade the firmware myself, and they've yet to have an NA release date for Droid 2.2. Eventually, I

  • by gmuslera (3436)
    In my case, my desktop is safer than my PC. Even if i run linux in both (Ubuntu in my desktop, Maemo in my N900) the difference is more regarding physical security than logical one.
  • The PC was invented before the internet and the security model was set up to allow everyone to do almost anything

    the smart phone was made for the internet and manufacturers seem to be locking them down. completely opposite of the PC

    • by Microlith (54737)

      the smart phone was made for the internet and manufacturers seem to be locking them down. completely opposite of the PC

      Except you're being put in the position of an unprivileged user even if you buy the device outright, and the carrier/handset vendor is retaining the position of "system admin" and treating you like a potential hostile.

      I wouldn't mind if, like the Nexus One or N900, you could assume root via a few non-trivial but non-PITA steps, but they seem determined to force you to exploit your own prope

      • Fair enough - a week of playing with my new HTC desire has left me feeling pretty hostile to my carrier!

        I am particularly hostile: because I cant login as root! I also want to open a terminal window and SSH into my servers.

        • Re: (Score:3, Interesting)

          by Sax Maniac (88550)
          ConnectBot lets you ssh anywhere without rooting. As for root, it's not as useful as it seems once you have CyanogenMod installed.
        • Re: (Score:3, Interesting)

          by RMH101 (636144)
          Head over to xda-developers.com and install a rooted ROM. It's pretty easy, and they're very nice. Tend to be faster, more featureful and more stable than OEM if you pick the right one. I like AuraxTSense 7.1 on my Desire. It also adds open VPN, which is pretty nice.
    • by ADRA (37398)

      Smart phones came from dumb cell phones. Appliances that you had no control over. If anything, Cell Phones are going the way of the open architecture. Give 5-10 years and we'll probably have the same environment for development as we do for PC's. This is amplified by the fact that there's so much competition right now to get developers onto their platforms. The more you entice them, the easier you need to make the system to development on. Short-sided market driven decisions in OS and API design can cause l

  • Intel clearly sees this as a huge future market, and were willing to drop several billion to get a good place in it. Your phone doesnt have a security chip? You fucked.
    • by hedwards (940851)
      Chips can be cracked and worked around, at least for any computer that most people would be willing to buy. I personally wouldn't be willing to buy a desktop that was as locked down as my PS3 for computing, even if it did make it really, really tough to run unsigned code. Hardware measures like the NX-Bit and virtualization features do however go a fair distance towards the goal, the problem ultimately is that as the hardware and software gets better, the user will even more than now become the major target
  • by hellfire (86129) <deviladv.gmail@com> on Tuesday August 31, 2010 @05:06PM (#33429936) Homepage

    I keep hearing a lot of theories about security from the tech media like they know security. The problem is that security is a great way to scare up hits and freak people out so it's useful to write articles pandering in one direction or another, but there's rarely any true science to the articles, no figures, no statistics, no hard examples. This is because all that is boring and doesn't get hits, but it's what it takes to truly determine what is and what is not secure. Nothing is 100% secure, but then again we have this false sense of how architectures and security work. It's just BS.

    This is the same kind of argument about how pundits spread the myth Macs are not any more secure than windows because hackers aren't targeting it. There's no evidence to back that statement up, and there's no evidence that Android less secure just because there are various flavors. In fact that can make it harder because one hack might not work on multiple flavors. That's even one of Androids problems now, that it's sometimes difficult to get a single app to work on multiple Android OS devices. You could then posit that the iPhone is easier to hack because the OS is so similar and the number of iOS devices in the wild is much higher than Android. But that's BS too because the iPhone is such a locked down system that in order to install anything you have to go thru the iTunes app store gatekeepers. The other way in is thru Safari, but that's really the only other way, and well now we know the security of Safari is BS because of that hole that they found in iOS 4 they used for jailbreaking. But compared to windows and compared to each other, which of these has had more critical vulnerabilities? The article gives me nothing.

    Despite all this positing, it comes down to number of hacks, and what the hacks are. I could not truly begin to tell you which handhelds are more secure than others because no one, including this article, has any facts. The article eludes to "security circles" but who knows who those people are.

    I think we should ban security articles from Slashdot unless they have a certain level of scientific statistics or hardcore evidence. Most articles about computer security on slashdot are not news for nerds, they are news for "platform fanboi weenies who want to start a flame war about which platform is more secure."

    • My old palm phone is the most secure handheld in existence... at least once I ran it over with my motorcycle. =\

  • by antdude (79039) on Tuesday August 31, 2010 @05:19PM (#33430096) Homepage Journal

    http://infoworld.com/print/135570 [infoworld.com] ... You're welcome! :)

  • "And the biggest bulls-eye appears to be on Android, in large part because its architecture is most like that of the desktop PC"

    This seems like a very dubious claim to me. From my perspective, iOS seems much more similar in architecture to the desktop than Android.

    iOS apps are native compiled, written in dialect of a language that is famous for buffer overruns (C), and the userland is a modified version of a desktop operating system.

    Android, while also based on a desktop OS (Linux) at the kernel level, has

    • by mjwx (966435)

      This seems like a very dubious claim to me.

      To me as well.

      From my perspective, iOS seems much more similar in architecture to the desktop than Android.

      But not for this reason. Android has a lot in common with Linux desktops, far more then IOS has in common with OSX desktops but unlike OSX, Linux does not make serious security concessions for "Just Working".

      But what will ultimately decide what platform will be targeted will be two factors. First the ease of finding an exploitable vulnerability, in this

  • My Smartphone is safer than most PCs because most PCs run Windows. Windows is designed so that all programs share a common registry. The problem in that lies in the fact that just about anything can modify that same registry.

    I don't see my phone (Android) having that problem. The only thing I foresee happening realistically any time soon is by means of social engineering, as opposed to other methods.

The shortest distance between two points is under construction. -- Noelie Alito

Working...