Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Your Smartphone Is Safer Than Your PC — For Now

CmdrTaco posted more than 3 years ago | from the ominous-chords-go-here dept.

Security 125

snydeq writes "InfoWorld's Galen Gruman reports on the future of mobile security — one that will see a significant rise in exploits as valuable information increasingly migrates to mobile devices. To date, sandboxing and code-signing have helped make mobile OSes relatively secure, when compared with their desktop brethren. But as devices store more valuable information than email, they will become more enticing to hackers currently breaking into Windows PCs. And the biggest bulls-eye appears to be on Android, in large part because its architecture is most like that of the desktop PC but also because there are so many variants in use — too many for Google or the carriers to patch securely. And as the PDF-jailbreak vulnerability showed, sandboxing has its limits when it comes to securing the browser — the most likely point of entry for exploits not due to the rise of extensions, helper objects, and plug-ins on the mobile Web."

Sorry! There are no comments related to the filter you selected.

PDF (0, Flamebait)

grub (11606) | more than 3 years ago | (#33428788)


I don't need safety, my phone is magical!

Re:PDF (1)

Yvan256 (722131) | more than 3 years ago | (#33429076)

What about anti-wizard software?

Re:PDF (2, Funny)

emocomputerjock (1099941) | more than 3 years ago | (#33429518)

That's what saving throws are for.

Re:PDF (1)

kenj0418 (230916) | more than 3 years ago | (#33429656)

Wouldn't that void my warranty?

Re:PDF (1)

geminidomino (614729) | more than 3 years ago | (#33430250)

Only if you roll a natural 1.

Re:PDF (2)

grub (11606) | more than 3 years ago | (#33429686)

Your iPhone needs to be made with finely ground unicorn horns, that means only the 3GS and up. The older models were made with pixie dust embedded in the circuit boards.

Irrelevant to me (5, Funny)

Anonymous Coward | more than 3 years ago | (#33428806)

I have a stupid phone.

Re:Irrelevant to me (1, Insightful)

Jurily (900488) | more than 3 years ago | (#33429126)

Agreed. I'd love to see someone hack into my $10 Alcatel.

Re:Irrelevant to me (2, Funny)

maxwell demon (590494) | more than 3 years ago | (#33429326)

Give me your phone and an axe, and I'll show you. :-)

Re:Irrelevant to me (1)

marcello_dl (667940) | more than 3 years ago | (#33430712)

Ummm what if you are with an axe and demand the phone and the password? Maybe we are not considering some oldschool attacks :D

Re:Irrelevant to me (3, Funny)

rthille (8526) | more than 3 years ago | (#33429328)

Your bank account is 42910-44937
You really shouldn't like to your girlfriend like that
And call your mother more often.

-The NSA

Re:Irrelevant to me (0)

Anonymous Coward | more than 3 years ago | (#33429394)

42910-44937? That's amazing! I have the same combination on my luggage!

Re:Irrelevant to me (1, Funny)

Anonymous Coward | more than 3 years ago | (#33429412)

Surveillance flatters me. My narcissism knows no bounds.
 

Re:Irrelevant to me (3, Informative)

Jurily (900488) | more than 3 years ago | (#33430062)

your girlfriend

You know this is Slashdot, right?

Re:Irrelevant to me (0)

Anonymous Coward | more than 3 years ago | (#33429484)

Got it. You have an iPhone...?

Re:Irrelevant to me (1)

pckl300 (1525891) | more than 3 years ago | (#33429690)

The correct term is 'intellectually challenged' :P

Well, there is always the secure option. (1)

Minion of Eris (1574569) | more than 3 years ago | (#33428862)

If you want safety and security - use a BlackBerry. Just ask India!

This is why I prefer my BB (1, Interesting)

PhuFighter (1172899) | more than 3 years ago | (#33428864)

.. over my iphone..and putting off getting an Android. The BB may be clunky, but I've a lot more confidence in it (so far) than iOS4/iPhoneOS 3.

Re:This is why I prefer my BB (1)

MozeeToby (1163751) | more than 3 years ago | (#33428938)

Like the article says, Android is becoming a big target these days and yet no one has found any significant exploits to its security model. Everything that I've read seems to think that it is as bulletproof as a modern, complex OS can be. That isn't to say that there won't be the occasional flaw but it is almost certainly orders of magnitude more secure than a certain piece of software that runs on a few billion computers around the world (including, I suspect, the majority of Slashdotters).

Re:This is why I prefer my BB (2, Interesting)

jedidiah (1196) | more than 3 years ago | (#33428980)

The problem with all of this nonsense is that there seems to be the implicit
assumption that Windows is the yardstick. Windows is the single worst thing
out there. Even all of the other desktop OSen are much less of the problem.

Clearly the dividing line isn't "desktop OS' versus 'mobile OS'.

They are really more alike then they are different.

So it used to be "PCs are bad, flee to Macs and you will be safe".
Instead now it's "PCs are bad, flee to iPods and you will be safe".

Re:This is why I prefer my BB (2, Funny)

RyuuzakiTetsuya (195424) | more than 3 years ago | (#33429060)

my iPod nano's never had a virus, a worm or a trojan, but a Greek dude with a bad cold did sneeze on it once.

Re:This is why I prefer my BB (0, Troll)

negRo_slim (636783) | more than 3 years ago | (#33429348)

Windows is the single worst thing out there.

Or more likely, your simply inept [charlespetzold.com] .

Re:This is why I prefer my BB (2, Insightful)

dc29A (636871) | more than 3 years ago | (#33429430)

Windows is the single worst thing out there.

Or more likely, your simply inept [charlespetzold.com] .

Ah ... the irony!

Re:This is why I prefer my BB (0, Informative)

Anonymous Coward | more than 3 years ago | (#33429542)

If I were to go on security alone, I'd go with BB, then Windows Mobile. After that, the N900, and after that, the iPhone then Android.

Android really needs file encryption to be able to be a useful candidate in the enterprise market. RIM devices have this, Windows Mobile has had it since 6.0, and the iPhone has encryption for a few things. Android only encrypts apps on the SD card.

Are variants a bad thing? (4, Insightful)

DrXym (126579) | more than 3 years ago | (#33428906)

And the biggest bulls-eye appears to be on Android, in large part because its architecture is most like that of the desktop PC but also because there are so many variants in use -- too many for Google or the carriers to patch securely.

So if an exploit occurs it will likely only affect some handsets as opposed to every handset.

Re:Are variants a bad thing? (4, Insightful)

John Hasler (414242) | more than 3 years ago | (#33429138)

So if an exploit occurs it will likely only affect some [Android] handsets as opposed to every handset.

But the scary news stories will omit that little detail.

Re:Are variants a bad thing? (3, Insightful)

beakerMeep (716990) | more than 3 years ago | (#33430482)

Indeed. And as the Apple PDF exploit showed, Android is in trouble.

Re:Are variants a bad thing? (1, Flamebait)

node 3 (115640) | more than 3 years ago | (#33429166)

And the biggest bulls-eye appears to be on Android, in large part because its architecture is most like that of the desktop PC but also because there are so many variants in use -- too many for Google or the carriers to patch securely.

So if an exploit occurs it will likely only affect some handsets as opposed to every handset.

And if a fix is created, it will only be applied to some handsets as opposed to every handset.

Re:Are variants a bad thing? (-1, Flamebait)

Anonymous Coward | more than 3 years ago | (#33429420)

And the biggest bulls-eye appears to be on Android, in large part because its architecture is most like that of the desktop PC but also because there are so many variants in use -- too many for Google or the carriers to patch securely.

So if an exploit occurs it will likely only affect some handsets as opposed to every handset.

And if a fix is created, it will only be applied to some handsets as opposed to every handset.

And if a fix is created, it will only need to be applied to some handsets as opposed to every handset. Since, ya know, only some of them were affected in the first place. Oops, did I poke a giant hole in your flamebait?

Re:Are variants a bad thing? (1)

2names (531755) | more than 3 years ago | (#33430022)

And if a fix is created, it will only be applied to some handsets as opposed to every handset.

Well, DUH! That's because not every handset will need it.

Re:Are variants a bad thing? (3, Insightful)

djdanlib (732853) | more than 3 years ago | (#33429214)

So we'll all be depending on multiple carriers' good patching practices, to make sure the patch for foolib-1.2.3-r4 gets pushed to all their Frobnitz Model 200 phones that they released two years ago and have since deprecated and replaced with Model 201, 220, 240, and 250, now with more shiny (but everyone still gets them because they're free with a new contract.) And by the way, it's going to be on your data bill. Call me pessimistic, but I don't think it'll happen in a timely fashion when someone discovers a vulnerability.

Crackers compete over who can own the most boxes just so they can have bragging rights. Oh look, such-and-such group disabled e911 for 20,000 people, why hasn't OUR group done that yet? We'd better do something even bigger so we can be elite again. Someone will find the loose rivet in the armor, and it'll be like a colonial land grab for a few months until the patch gets distributed.

Re:Are variants a bad thing? (1)

PitaBred (632671) | more than 3 years ago | (#33429260)

Man, am I glad that I got a Nexus One. This kind of thing is the reason that Google pushed to get people to buy phones separate from the carriers. Too bad the carriers are too strong.

Re:Are variants a bad thing? (1)

CastrTroy (595695) | more than 3 years ago | (#33429444)

The reason that people get phones from their carriers is that they get a discount on their phone when they buy it from the carrier and sign a contract. The problem is, is that you can't buy your own phone, and have a cheaper rate plan. The rate plan is the same price regardless of where your phone came from or whether or not you are on a contract. So you actually have to spend a lot more money to get a phone from someone other than your carrier.

Re:Are variants a bad thing? (1)

Belial6 (794905) | more than 3 years ago | (#33429760)

T-Mobile gives you a better rate if you bring your own phone.

Re:Are variants a bad thing? (0)

Anonymous Coward | more than 3 years ago | (#33429880)

Wrong. See T-Mobile. (Yee, they're the only one in the US, so your point broadly applies to the US market as a whole. But the prevalence of people buying subsidized phones even on T-mobile suggests there's more to it.)

Re:Are variants a bad thing? (1)

goarilla (908067) | more than 3 years ago | (#33429970)

so you can do what ? build a cross platform compiler, patch the nexus one's source
( if you can get it), and be more secure (patchwise and services wise) than those
'upstream carriers' ?

unlimited access is nice for adding features or doing different things with them ... not
so for locking down the (purpose-specific) system-util for better security on your OWN.

Re:Are variants a bad thing? (1)

mlts (1038732) | more than 3 years ago | (#33429660)

Most likely Google will throw the kill switch and the offending app gets purged from devices.

Assuming the malware didn't get root access, of course. If the user does allow it through su, all bets are off.

Re:Are variants a bad thing? (3, Insightful)

tlhIngan (30335) | more than 3 years ago | (#33429790)

So we'll all be depending on multiple carriers' good patching practices, to make sure the patch for foolib-1.2.3-r4 gets pushed to all their Frobnitz Model 200 phones that they released two years ago and have since deprecated and replaced with Model 201, 220, 240, and 250, now with more shiny (but everyone still gets them because they're free with a new contract.) And by the way, it's going to be on your data bill. Call me pessimistic, but I don't think it'll happen in a timely fashion when someone discovers a vulnerability.

It's already happened on Android. Manufacturers are out making their latest rev and they ignore the bugfiles to their current line of phones. Or they do and pass it onto the carriers who may or may not force an update. Of course, if said update will remove things like root and custom ROMs, they'll probably push it.

But phones getting abandoned at whatever Android version they shipped with are already happening - I think the early Samsung phones were promised 2.0, but ended up with 1.6 only with an official letter. And others are stuck with 2.1 with no upgrade to 2.2. The only good part is these phones often are early models and easy to root and recover, so unofficial ROMs exist. But later ones may not be so lucky.

Really, the only Android phone that's not under carrier control is the Nexus One, which gets updates straight from Google. The wierd thing is, why can't Google pull an Apple? The iPhone gets updates from Apple, leaving out the carrier middleman, even if the user is paying a contract on the iPhone.

Google's big enough, let's see it happen and end all this Android loaded with crapware stuff.

Re:Are variants a bad thing? (3, Informative)

Sancho (17056) | more than 3 years ago | (#33430056)

The wierd thing is, why can't Google pull an Apple? The iPhone gets updates from Apple, leaving out the carrier middleman, even if the user is paying a contract on the iPhone.

Because Android is an open platform. The carriers take Android, mold it to fit their needs, and put it on their phones. Google, or rather the Open Handset Alliance, doesn't have any say on it. That's how carriers can get away with modifying the source of the Hotspot app to only work if the customer pays extra.

This is the downside to GPLv2. The Tivoization loophole means that carriers can do this, release the source, and you still can't (necessarily) modify the source and put it on your phone.

Google started taking steps to address some of this by moving more of their apps to the app store, but you still have issues with system libraries and the kernel. Without root, an app can't update these.

Re:Are variants a bad thing? (1)

SoftwareArtist (1472499) | more than 3 years ago | (#33430786)

I wouldn't be surprised if this eventually leads to a decrease in customization/fragmentation/whatever you want to call it. Handset vendors insist on customizing the OS because they want to "differentiate themselves". So they stick on a custom UI, a bunch of their own apps, etc. But they're already discovering the downside to this: the more they customize, the more they're stuck maintaining themselves. Look how many phones don't even have Android 2.1 yet, much less 2.2. They're discovering that it takes a lot of work to port their customizations to a new OS version. The situation will become a lot worse when malware writers start to actively target Android and Google starts to regularly issue security patches. Integrating and testing those patches on a timely basis will become a huge burden for them. At that point, they may start deciding, "Just shipping stock Android wouldn't be such a bad thing after all."

Re:Are variants a bad thing? (0)

Anonymous Coward | more than 3 years ago | (#33429534)

I think the implication that variants are bad is due to the fact that it leaves patching up to the carriers. There has already been controvery because some carriers are refusing to update phones that are less than a year old to Android 2.2.

Yes, geeks with such new-yet-abandoned phones can seek out and install the updates from third parties. I remind you that geeks are not in the majority, and most people will just blithely keep using whatever version of mobile OS is on their phone, secure or not-- i.e., the exact same way they use their Windows PCs, chock full of spyware, missing patches, and with antivirus whos trial version stopped working a month or two after they got their computer.

Example: iPhone (1, Insightful)

rshxd (1875730) | more than 3 years ago | (#33428914)

Send it a .pdf and you can get root access aka jailbreaking it.

Re:Example: iPhone (1, Funny)

jgagnon (1663075) | more than 3 years ago | (#33429238)

Send it flowers or candy instead and you might get lucky...

And the first ones out of the gate will be easy (3, Insightful)

elrous0 (869638) | more than 3 years ago | (#33428920)

People have such a false sense of security about their smartphones right now that the first virus or truly inventive hack is going to have a frickin' field day. iPhone users are particularly cocky about how secure their phone is (and Apple isn't exactly a speed demon when it comes to security patches for their OS's either).

Re:And the first ones out of the gate will be easy (0, Troll)

rshxd (1875730) | more than 3 years ago | (#33428968)

Look at Sophos' Facebook group and the typical Mac snobbery of "I don't get viruses" when a virus alert is posted by Sophos.

Re:And the first ones out of the gate will be easy (0)

Anonymous Coward | more than 3 years ago | (#33429164)

Except that virus != trojan. Most users don't seem to know the difference, but I would expect a Slashdot user to know better.

Re:And the first ones out of the gate will be easy (1)

jgagnon (1663075) | more than 3 years ago | (#33429262)

Does that little fact really matter when someone's phone is still compromised once all is said and done? And couldn't a trojan open the door to viruses and rootkits?

Re:And the first ones out of the gate will be easy (0)

Anonymous Coward | more than 3 years ago | (#33429458)

Virus = you don't do shit and your device gets infected.
Trojan = you need to be dumb enough to type your root password to an unknown application that has no business asking for your root password in the first place.

That's far from a little fact and yes it really does matter.

Re:And the first ones out of the gate will be easy (0)

Anonymous Coward | more than 3 years ago | (#33429446)

Look at Sophos' Facebook group and the typical Mac snobbery of "I don't get viruses" when a virus alert is posted by Sophos.

If Sophos didn't cry wolf so often, this might not be the case.

"Theoretically dagnerous obscure proof-of-concept exploit developed! OMG you must buy our product NOW or your Mac will explode!"

Yeah, can't imagine why Mac users don't take security warnings seriously

Re:And the first ones out of the gate will be easy (4, Insightful)

node 3 (115640) | more than 3 years ago | (#33429232)

People have been saying this about the Mac for a decade now, too. I'm glad I didn't hold my breath waiting for this supposed apocalyptic day of comeuppance...

Re:And the first ones out of the gate will be easy (4, Funny)

recoiledsnake (879048) | more than 3 years ago | (#33429626)

The real reason is that malware authors cannot afford Macs :)

Re:And the first ones out of the gate will be easy (-1, Troll)

aergern (127031) | more than 3 years ago | (#33430146)

No, this is because Mac's are built on UNIX .. just because it has a pretty GUI doesn't make it a haven for malware and self perpetuating virus infections like Windows. If I had a dollar for every day of every month of every year that people said " macs don't have enough market to warrant virus writers caring." but meanwhile their market share has grown and grown year after year. It's the same old crap about UNIX/Linux isn't popular enough when it runs a MUCH larger portion of the Internet the anything else. Why WOULDN'T it be a target? Why can't these script kiddies hack root on these boxes and turn them into zombies.

This whole discussion is just silly.

Re:And the first ones out of the gate will be easy (1)

mrwolf007 (1116997) | more than 3 years ago | (#33430208)

*cough* sure [iantivirus.com] *cough*
Less threats, sure. But far from completely secure.

Re:And the first ones out of the gate will be easy (0)

Anonymous Coward | more than 3 years ago | (#33431040)

I think the difference is that Mac/iPhone users will somehow see this as a feature. That recent PDF exploit that allowed iPhone users to jail-break their phones comes to mind--few seem to mind a random website could root their phone so easily if it could get tethering working...

Android less secure? (4, Insightful)

cyber-vandal (148830) | more than 3 years ago | (#33428928)

Windows is an easy target because it's a huge badly-secured monoculture. How does having several different versions of Android to attack make it similarly insecure?

Re:Android less secure? (0, Troll)

bsDaemon (87307) | more than 3 years ago | (#33428960)

Because the article author has an iPhone and wants to feel (even) better about himself?

Re:Android less secure? (1)

hedwards (940851) | more than 3 years ago | (#33429954)

Wouldn't it be easier to buy a black turtle neck and smile like a smug git, oh wait...

Re:Android less secure? (3, Interesting)

Microlith (54737) | more than 3 years ago | (#33428964)

I don't think it makes it more insecure so much as harder to close the holes. Handset vendors and carriers, for a long time, have worked with devices that generally could not be exploited in such a fashion, and probably don't have any means of getting such fixes out to their users within an acceptable time frame.

Re:Android less secure? (0)

Anonymous Coward | more than 3 years ago | (#33428998)

Android's weakness will be the carriers taking forever to push out a patch to their specific flavor of Android. Will the carriers ban your phone after they stop officially supporting it and you rooted it to apply patches?

Re:Android less secure? (0)

Anonymous Coward | more than 3 years ago | (#33429342)

yes. yes they will

Re:Android less secure? (1)

jedidiah (1196) | more than 3 years ago | (#33429016)

...what I want to know are what are these similar mistakes that Android or PhoneOS is supposed to be making?

HELL: what similar mistakes are Linux, Solaris, MacOS and FreeBSD supposed to be making?

Re:Android less secure? (4, Insightful)

bsDaemon (87307) | more than 3 years ago | (#33429090)

The mistake of letting users interact with them. Users are the number one security flaw in any system.

Re:Android less secure? (2, Funny)

node 3 (115640) | more than 3 years ago | (#33429264)

The mistake of letting users interact with them. Users are the number one security flaw in any system.

Sure, a daemon would say that, wouldn't it?

Re:Android less secure? (1)

smolloy (1250188) | more than 3 years ago | (#33430068)

Replying to undo incorrect moderation...

Re:Android less secure? (0, Offtopic)

SleazyRidr (1563649) | more than 3 years ago | (#33430818)

Usually when I mess up my moderation, I try to play it off by overusing some already overused /. meme.

For instance, in this situation, I would have posted something along the lines of 'I, for one, welcome our security-flaw-noticing daemon overlords.'

Re:Android less secure? (1)

jgagnon (1663075) | more than 3 years ago | (#33429284)

The root of the problem: people make really crappy users. Robots and animals are a far better choice.

Re:Android less secure? (1)

hedwards (940851) | more than 3 years ago | (#33429976)

OTOH, stay away from those sipping birds, nothin' but trouble.

Re:Android less secure? (1, Insightful)

bit01 (644603) | more than 3 years ago | (#33430306)

The mistake of letting users interact with them. Users are the number one security flaw in any system.

No, this is a myth perpetuated by second-rate programmers and system administrators to cover up their own incompetence.

The number one security flaw is incompetent programmers and administrators not designing their systems for their target audience.

e.g. Putting executable content into documents by default when it is almost always not needed or wanted. It's not rocket science.

---

Anonymous commercial speech = fraud

Re:Android less secure? (1)

mlts (1038732) | more than 3 years ago | (#33429718)

The "mistake" that non-Windows platforms make is the fact that developers on that platform actually value what they are developing on. There isn't any of that on Windows, and Windows devs feel free to crap where they sleep.

Platform loyalty is important. Not many programmers on Windows would go out of their way to deal with the latest worm or Trojan (unless it fattened their wallets, of course), but on other platforms, almost everyone would ensure that it would be stopped. Mac devs don't like viruses (especially older ones which dealt with that crud in the pre OS X days), so would actively find a way to stop it until Apple put out an official patch. Linux distros would have patches out in minutes to hours.

Re:Android less secure? (1)

hedwards (940851) | more than 3 years ago | (#33430044)

I suspect that part of the problem with Windows is that MS doesn't enforce the kind of cleanliness and neatness of code that some of the competitors do. Granted all OSes have some cruft and scariness in places, but most of the ones that are known for stability have long since shaped up and enforced something along the lines of style [freebsd.org] I'm sure that most modern projects of any size and reliability have something similar to work from. The more uniform the style is and the better the adherence the easier it is to find bugs that might be hiding security problems.

The other thing is that it's very difficult to get a look at the Windows source code legitimately, without being paid to work on it. Whereas with Linux or *BSD if you have a bug you've got the option of fixing it yourself or if you don't have the time or expertise you can usually find somebody who's willing to do so for a price. Frequently is thrilled to get to fix the problem on somebody else's dime.

Beyond that, backwards compatibility has to be careful considered and engineered otherwise you can easily end up in the situation where a vulnerability exists due to legacy code or the model itself is prone to exploitation.

Re:Android less secure? (0)

Anonymous Coward | more than 3 years ago | (#33431204)

What I find ironic is that the blackhats in Russia and China get unfettered access to the source code to develop any exploit they care for, while people who depend on Microsoft stuff for their security don't get this ability.

Why does Microsoft make the playing field so unfair for the white-hats? This by itself is a good reason to move to an open source platform -- at least everyone knows what is going on.

Re:Android less secure? (0, Troll)

Anonymous Coward | more than 3 years ago | (#33429048)

Windows is an easy target because it's a huge badly-secured monoculture. How does having several different versions of Android to attack make it similarly insecure?

Its not that its badly secured, it is more secure than any other operating system, simply because everyone uses it, for most hackers breaking through a Windows computer is almost muscle memory simply becuase they do it so much, now linux it has its potentials to be hacked but why hack the same thing we use to hack windows, its all about the number of deployed systems. Prime example, in 2006 Mac OS X had 3 known viruses written for it, no one chose to hack it, now look, Snow Leopard has antivirus embedded in the OS. Read a few more books before you decide to make such a half-assed bold comment like that.

Re:Android less secure? (2)

jonescb (1888008) | more than 3 years ago | (#33429248)

Ah yes, the old security by obscurity argument. If these "hackers" were worth their salt they'd be doing something a bit more sophisticated about exploiting Linux servers than slamming them with botnets with DDOS/brute force attacks.

Re:Android less secure? (1, Troll)

node 3 (115640) | more than 3 years ago | (#33429312)

it [Windows] is more secure than any other operating system

Um...

Prime example, in 2006 Mac OS X had 3 known viruses written for it

Wrong. There are *no* viruses for Mac OS X. There are a handful of trojans, none of which are even remotely wide-spread (even adjusting for OS X's relative install base) and all of which require the user to enter in their admin password (a huge governor which helps limit the rate at which malware can spread).

Snow Leopard has antivirus embedded in the OS

Wrong. Snow Leopard checks for a handful of trojans/malware. There are no viruses for Mac OS X. Embedding anti-virus would be pointless, unless you just want to be nice and scan for Windows viruses.

Re:Android less secure? (1)

Seth Kriticos (1227934) | more than 3 years ago | (#33429378)

Though Linux is not exactly visible on consumer PC's, it still runs on the majority of servers around the world.. targets you'd normally count as even more attractive as they are connected 24/7 and not even hidden behind NAT's, presenting a wide and valuable targeting space. Your argument is invalid, come up with something that is founded on some real data please.

Re:Android less secure? (1)

CastrTroy (595695) | more than 3 years ago | (#33429628)

No, they aren't behind NATs, but if properly configured, they are behind secured firewalls, making them a lot harder to break into. And even if you do break into them, they are a lot harder to do anything with, because they are behind a firewall. Really the reason that Windows PCs are so much more vulnerable is because they have idiots operating them. Once the user opts to run a program, the program can pretty much do anything with that machine. All you have to do is promise smiley faces, and you'll have millions windows users actively downloading your application, and running it. It doesn't even matter if it flashes warnings saying that the app requires admin privileges. The user will happen just click on Next/OK/Yes until program is successfully installed, without reading a single thing. Once the user opts to run a program, there's not much any operating system or virus software can do. Even if you aren't running as admin, you can still have your program re-run every time the user logs in, and you can still cause quite a bit of damage, either by deleting the users files, or by sending the users data out to a server so some hacker can find interesting data.

Marketing (3, Interesting)

Kupfernigk (1190345) | more than 3 years ago | (#33429212)

Apple is trying to attack Android, which is growing in marketshare much faster than the iPhone. So they are trying to encourage the view that a monoculture is a virtue, and the various flavours of Android are somehow fracturing the market. (One phone to rule them all...)

Personally I think this is complete nonsense. Android runs on a lot of devices - soon to be added is the Toshiba AC100 netbook, so it will run on everything from entry level phones to small computers - which involves numerous changes in UI arising from optimisation and features. But the underlying architecture should make it possible to ensure that things are properly partitioned to give a robust security model, and Google isn't exactly short of brainpower. I suspect that just as we had the Microsoft trolls trying to minimise reports of Windows security issues, here we have Apple trolls trying to find narratives to attack Android.

And no, I don't use Android.

Re:Marketing (1)

mlts (1038732) | more than 3 years ago | (#33429902)

Devil's (or more exactly Apple's) advocate here:

From a QA perspective, having eight devices to have to test on (four iPhones, iPad, iPad 3G, two iPod Touch models) is a lot easier than checking to see if your device works with different displays, resolutions keyboards, trackballs (physical and virtual), status lights, cameras, and so on.

One mistake on your Android app, and your app's review status starts going deep in a hole with tons of "Force closes on the Blarf, refunded." on the Marketplace review sheet.

Re:Android less secure? (1)

Wiarumas (919682) | more than 3 years ago | (#33429552)

Security through software proliferation?

Re:Android less secure? (1)

hedwards (940851) | more than 3 years ago | (#33430074)

Not really, it increases the likelihood that a vulnerability will be found, but decreases the likelihood that the vulnerability will affect a large number of phones. I suspect that it's ultimately a wash. More possible holes but likely fewer devices that contain said holes to exploit.

Re:Android less secure? (3, Interesting)

akadruid (606405) | more than 3 years ago | (#33429682)

Windows is a high value target, which was once crippled by it's backwards compatability with DOS and low skilled userbase. Microsoft, whatever their flaws, have some properly clever people and serious vested interest in addressing this problem, and they've finally put out a release that is fairly secure out of the box and somewhat usable - while still providing fairly timely security patches for a 10 year old release. Which is why the most serious threats are now coming from widely deployed software from less responsible companies (Adobe).

Android is the exact opposite. Very few smartphone manufacturers care enough to issue regular updates for their phones, especially once you get outside of the US market. Even on the US market, most smartphones have had exactly one update: from 1.5/1.6 to 2.0/2.1 usually. No monthly security updates, and nothing at all for obsolete phones over 12 months old. You'd better hope that nobody else has the time to look at your phone that your carrier has forgotten about.

Insecure (1)

phorm (591458) | more than 3 years ago | (#33429900)

Yes, if a large portion of those version are old, with known exploits, and unpatched...
Any less secure than other phones? Maybe not compared to some, though Apple is actually fairly "pushy" when it comes to the "there's a new update for your phone/itunes/whatever" thing.

What pisses me off is companies like Motorola. My phone has known bugs with known fixes, but since it's a Milestone and not a Droid, I can't upgrade the firmware myself, and they've yet to have an NA release date for Droid 2.2. Eventually, I'm sure they'll just abandon the phone and leave it un-patchable in favour of the newer model, Jerks.

My next phone will still likely be Android, but likely an HTC (or another brand that's not evil, no more moto for me).

Re:Android less secure? (0)

Anonymous Coward | more than 3 years ago | (#33429994)

That's not half of it...

According to TFS, Android is the most like the desktop PC. Now I was under the impression from my Mac fanboi friends that the iPhone runs OS X with only a different GUI -- either they're wrong, or the proposed justification for why Android is less secure than iOS is wrong... Mac-baiting aside, and moving to platforms that I actually know something of, I can assure you that Maemo and Meego are much more like a desktop PC running a typical GNU/Linux OS than Android is, and as I understand it WebOS is somewhat closer as well.

But none of the mobile OSes is at all close to that infested XP box next door, which is the image TFS (and, I presume, TFA) was trying to project... Makes the whole argument fall to bits on inspection, because who would complain if their phone were "as dangerous as" Mac OS X or Linux PCs?
,

Re:Android less secure? (1)

99BottlesOfBeerInMyF (813746) | more than 3 years ago | (#33430534)

According to TFS, Android is the most like the desktop PC. Now I was under the impression from my Mac fanboi friends that the iPhone runs OS X with only a different GUI -- either they're wrong, or the proposed justification for why Android is less secure than iOS is wrong...

First, iOS is a variant of OS X, but with all the software signed, vetted(weakly), and in sandboxes as a requirement. Those are all optional and used for a small subset of software on the desktop version of OS X. By analogy, both the NSA document portal (running SELinux and strictly maintained) and my former company's remote development wiki are running Linux. That doesn't mean the OS is the important factor as to whether they are both secure or not.

The way Android handsets are most similar to security plagued desktop computers is that in both cases commercial companies are using an OS from another vendor and installing it on their commercial offerings without any pre-established method for end users to freely and easily keep their own OS up to date without help. The average person will buy a phone, install software, and if their hardware vendor does not push security updates upon them (some will for a period of time, some won't ever) their system will become out of date and vulnerable to many know exploits, just as Windows XP is today.

...Makes the whole argument fall to bits on inspection...

I don't think so. You've predicated your argument upon how close in lineage and application compatibility the OS is to existing desktop OS's. If you don't make said assumption the argument makes a lot of sense. Also the potential solutions begin to make more sense, ranging from finding hardware vendors that vet and maintain their users systems for the life of the handset to placing OS and security updates into the hands of either Google or an independent body that is concerned about end users more than short term cost cutting.

Wrong (1)

gmuslera (3436) | more than 3 years ago | (#33429038)

In my case, my desktop is safer than my PC. Even if i run linux in both (Ubuntu in my desktop, Maemo in my N900) the difference is more regarding physical security than logical one.

Re:Wrong (0)

Anonymous Coward | more than 3 years ago | (#33429494)

In my case, my desktop is safer than my PC

and my sofa is safer than your desktop.

Different environment. (0)

Anonymous Coward | more than 3 years ago | (#33429142)

The only reason why this is true so far is that "the desktop" has been an unhealthy monoculture of a notoriously shoddy system, that couldn't, or when it could often as not wouldn't because "it wasn't a priority" sayeth the vendor, fix its problems at all, nevermind in a timely fashion. Widespread worst practices compounded the problem and equal developer unwillingness to address that compound the problem. I am quite happy this is much less the case in mobile computing, and for that reason alone we should keep multiple systems alive. Android, symbian, and so on. We need that diversity as much as we need open systems.

One might hope that now we know better, but whether we will do better is something else entirely. My guess is, we won't. It's been a long standing problem in the industry, commented years ago on by the late E.W. Dijkstra. And we have done little to nothing to fix it.

it's almost like we did a complete reboot (1)

alen (225700) | more than 3 years ago | (#33429146)

The PC was invented before the internet and the security model was set up to allow everyone to do almost anything

the smart phone was made for the internet and manufacturers seem to be locking them down. completely opposite of the PC

Re:it's almost like we did a complete reboot (1)

Microlith (54737) | more than 3 years ago | (#33429340)

the smart phone was made for the internet and manufacturers seem to be locking them down. completely opposite of the PC

Except you're being put in the position of an unprivileged user even if you buy the device outright, and the carrier/handset vendor is retaining the position of "system admin" and treating you like a potential hostile.

I wouldn't mind if, like the Nexus One or N900, you could assume root via a few non-trivial but non-PITA steps, but they seem determined to force you to exploit your own property just to retain ownership.

Re:it's almost like we did a complete reboot (2)

Anne Thwacks (531696) | more than 3 years ago | (#33429770)

Fair enough - a week of playing with my new HTC desire has left me feeling pretty hostile to my carrier!

I am particularly hostile: because I cant login as root! I also want to open a terminal window and SSH into my servers.

Re:it's almost like we did a complete reboot (2, Interesting)

Sax Maniac (88550) | more than 3 years ago | (#33430206)

ConnectBot lets you ssh anywhere without rooting. As for root, it's not as useful as it seems once you have CyanogenMod installed.

Intel buying mcafree (1)

Ryanrule (1657199) | more than 3 years ago | (#33429698)

Intel clearly sees this as a huge future market, and were willing to drop several billion to get a good place in it. Your phone doesnt have a security chip? You fucked.

Re:Intel buying mcafree (1)

hedwards (940851) | more than 3 years ago | (#33430116)

Chips can be cracked and worked around, at least for any computer that most people would be willing to buy. I personally wouldn't be willing to buy a desktop that was as locked down as my PS3 for computing, even if it did make it really, really tough to run unsigned code. Hardware measures like the NX-Bit and virtualization features do however go a fair distance towards the goal, the problem ultimately is that as the hardware and software gets better, the user will even more than now become the major target of the attacks. One of the very serious problems today is that DRM frequently requires special exceptions be added to the security software in order to run, opening up the possibility of somebody slipping a trojan or other piece of malware into that file.

Irrelevant for me... (-1, Redundant)

Anonymous Coward | more than 3 years ago | (#33429854)

...I don't use Windows.

Tech media has no clue about true security (2, Interesting)

hellfire (86129) | more than 3 years ago | (#33429936)

I keep hearing a lot of theories about security from the tech media like they know security. The problem is that security is a great way to scare up hits and freak people out so it's useful to write articles pandering in one direction or another, but there's rarely any true science to the articles, no figures, no statistics, no hard examples. This is because all that is boring and doesn't get hits, but it's what it takes to truly determine what is and what is not secure. Nothing is 100% secure, but then again we have this false sense of how architectures and security work. It's just BS.

This is the same kind of argument about how pundits spread the myth Macs are not any more secure than windows because hackers aren't targeting it. There's no evidence to back that statement up, and there's no evidence that Android less secure just because there are various flavors. In fact that can make it harder because one hack might not work on multiple flavors. That's even one of Androids problems now, that it's sometimes difficult to get a single app to work on multiple Android OS devices. You could then posit that the iPhone is easier to hack because the OS is so similar and the number of iOS devices in the wild is much higher than Android. But that's BS too because the iPhone is such a locked down system that in order to install anything you have to go thru the iTunes app store gatekeepers. The other way in is thru Safari, but that's really the only other way, and well now we know the security of Safari is BS because of that hole that they found in iOS 4 they used for jailbreaking. But compared to windows and compared to each other, which of these has had more critical vulnerabilities? The article gives me nothing.

Despite all this positing, it comes down to number of hacks, and what the hacks are. I could not truly begin to tell you which handhelds are more secure than others because no one, including this article, has any facts. The article eludes to "security circles" but who knows who those people are.

I think we should ban security articles from Slashdot unless they have a certain level of scientific statistics or hardcore evidence. Most articles about computer security on slashdot are not news for nerds, they are news for "platform fanboi weenies who want to start a flame war about which platform is more secure."

Re:Tech media has no clue about true security (1)

geminidomino (614729) | more than 3 years ago | (#33430696)

My old palm phone is the most secure handheld in existence... at least once I ran it over with my motorcycle. =\

One print page for InfoWorld article. (2, Informative)

antdude (79039) | more than 3 years ago | (#33430096)

http://infoworld.com/print/135570 [infoworld.com] ... You're welcome! :)

wasn't the PDF jailbreak on iPhone (0)

Anonymous Coward | more than 3 years ago | (#33431064)

It is kind of funny that one needed to resort to an iPhone bug to support an article talking about how Android is unsafe...

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?