Android vs iOS: How Secure Are They?

INDROID iOS VS How Secure Are They? Both Android and iOS have: slide to unlock Traditional access control Such as passwords and idle-time screen locking to protect the device itself. Isolation Limiting a process's ability to access sensitive data or system resources from another process. Permissions-based access control Granting each application a set of permissions that limits its access to specified device data and systems. Limited hardware access Apps cannot directly access the underlying hardware. The hardware interactions are all controlled exclusively by a number of different layers of software which act as intermediaries between the application and the device itself. Resistance to web-based attacks Both systems have some built in capabilities to resist web-based attacks. HOWEVER... METHODS OF APPLICATION DISTRIBUTION Android has more distribution channels. With Android there are more opportunities and methods to load applications. iOS apps can only be distributed through the Apple app store. J App Store For example:Android devices support more than one app store as well as large-scale over- the- air app distribution. DATA ENCRYPTION AVAILABLE ON BOTH DEVICES There are different levels of encryption, and some of them are device-specific. The OSes provide mechanisms for apps to store secrets in ciphertext on disk; but apps don't always take advantage of these features. For example, data encrypted on your mobile device may be stored in plain text if you sync to a PC. APPLICATION SECURITY TESTING The level of verification on app security isn't the same between the various Android marketplaces and Apple's App Store. Security and privacy are not thoroughly tested and unauthorized access to sensitive data has already occurred in both the App Store and the Android Marketplace. APPLE SOMETIMES APPROVES APPS THEN DISAPPROVES THEM Apple has an approval process to place an application into the iTunes store. However, it's not hard to find examples of apps being removed from the store *after* they've been found to behave badly. ANDROID security features iOS security features • Permission-based access control: Permission-based access control: • When an application requests the use of a protected feature in iOS (such as accessing the user's current location) at runtime, the Os pops up a dialog box in the middle of the app and asks the user if he/she chooses to allow the application access to the resource. Many apps fail if the user chooses "no". Android's access control model is different than iOS: inside the application manifest, there is a static list of permissions that the Android application requests up front. The user is presented with the list at application installation time. • Installing Applications: The official Google marketplace allows remote installation of applications to your phone. It prompts the phone to accept the installation, therefore it is not possible to remotely install and RUN an auto erase or find me type application. Geolocation: Locates your phone when it's lost. This feature is provided by Apple as a feature of its operating system and accompanying online service. INDROID Weakness Example Auto Erase: • If your phone is lost or stolen you can wipe sensitive data from your device. In the event that the phone is returned, you can restore the information from the backups on your desktop. When this feature is enabled, 10 failed passcode attempts will automati- cally erase data from the device. Android Orphans Millions of Android phones that are still under contract cannot be updated to the latest version of the Android OS. please sir, may iOS Weakness Example Every iOS device running an OS lower than we have version 4.3.5 is vulnerable to a flaw called SSL MITM which hackers can exploit easily. Wild West Application Marketplace The application marketplace has lim- ited (if any) security implementation. Instead Google chose to allow nearly any application presented to the market to be published for user con- sumption. Google does not check the security of applications prior to general availability. some support? Since Apple won't allow certain device categories to be upgraded to this level, iPhone it means that there are millions of permanently exploitable devices out there. Android has a similar problem. vecteezy.com/ yaquiloco vecteezy.com/ belial90 If an iPhone owner chooses to jailbreak their phone he becomes more vulnerable to malware. Smartphone Manufacturers Can Modify the Phone UI* Google Android is designed to be modified by the carrier releasing the device. Because of this Android devices suffer from additions of software and Ul modifications that the smartphone owner doesn't want or need. iPhone jailbreaks exploit security holes that may also be exploited by hackers. One example was located in the iPhone PDF parser which contained a flaw that allowed a document to execute code. "User Interface SO YOU GOT A SMARTPHONE FOR CHRISTMAS? Here are 10 ways to protect it from hackers. • Change the phone password and your voicemail password. • Use mobile security software - e.g. Lookout. • Use a password/pin that is difficult for others to guess. • Use mobile device management software. • Set the phone so that it is password protected after 5 minutes of inactivity. • Back up your data. • Only enable the wireless networks/connections you use, e.g. if you • Don't view sensitive information on public Wi-Fi. don't use a Bluetooth device then don't turn Bluetooth on! • Install OS updates as soon as they are available to ensure your smartphone firmware is up to date. • Only install applications from vendors you trust. Check out app reviews and app-sources before installing. Symantec (an Internet and device security company) concludes that even though iOS and Android both have their weaknesses, the mobile platforms are still much more secure than their PC counterparts. NOW THAT YOU HAVE THE INFORMATION. presented by VERACODE USE YOUR SMARTPHONE WISELY.