A quick note on mobile security
For almost 15 years, the mobile computing space has taken the world by storm. What used to take a laptop or desktop, can now be done in the palm of your hand.
A Brief History
The world of mobile devices has seen its landscape change throughout the years. Almost every tech company, device manufacturer and service provider has dipped its toe in the operating system pool at one time or another. Starting in 2000, companies like Ericsson, Nokia, Motorola and even Microsoft all attempted to be the next big thing in mobile device operating systems by putting out operating systems with names like EPOC, Symbian, and DangerOS. The industry has seen big players such as BlackBerry and Microsoft fall to the wayside as Google’s Android and Apple’s iOS have taken most of the industry market share. Microsoft officially stopped supporting Windows 10 Mobile December 10, 2019 and advised users to move to Android or Apple.
What’s better, Apple or Android?
According to lifewire.com (https://www.lifewire.com/reasons-iphone-is-more-secure-than-android-2000308), Android owns about 85% of mobile device market share, leaving Apple with about 15% of the mobile pie. That being said, in terms of the security of mobile operating systems Apple has long been considered the more secure operating system. Why? It’s a numbers game. When attackers choose a target, they typically choose the target that provides the best opportunity for success. Given Android’s share of the market, it seems like they win the award for the biggest target. The lifeware.com article provides statistics stating that 97% of all mobile malware is written to target Android devices due, in a large part, to the market share Android commands.
Another security feature that Apple iOS provides is Sandboxing. Sandboxing essentially allows each app to run in its own environment, with little access to other apps or the operating system. This protects the device in the event the app contains malicious code.
Regardless of the mobile device you're using, you have most likely downloaded a mobile app. If you are using an Apple device, you do this using the Apple Store, if you are using an Android device you would use the Google Play Store. What’s the difference? Functionally speaking, nothing (really). Both the Apple Store and Google Play Store allow users to search and download mobile apps and both Apple and Android platforms are susceptible to risk from their respective “stores”. The difference is in the details, Apple reviews every app before it is published in the App Store. Resulting in few malicious apps making it into the App Store. Google, on the other hand, in sticking with its open-source roots, has made publishing an app to the Google Play Store much quicker and does not include much scrutiny. This opens the door for attackers to publish malicious apps to the play store, much easier than Apple’s App Store. If you are not diligent about what you download, you could be downloading malicious code allowing attackers access to your device. It appears that Google is attempting to increase security in the Play Store. In a recent article published on thehakcernews.com (https://thehackernews.com/2020/02/android-adware-apps-banned.html), Google has banned 600 Android apps from the Play Store. This recent move is an attempt by Google to curtail advertisements within applications, but this along with the Google Play Protect option seems to indicate Google is taking mobile app security seriously.
The Root of the problem
Accessing the kernel of a mobile operating system is called “rooting” a device. More accurately, “rooting” is a term used when referencing Android devices and “jailbreaking” is the term used when referencing Apple iOS devices. It is considerably easier to “root” an Android device than it is to “jailbreak” an Apple device. This is another configuration that provides additional security to Apple’s platform. Rooting or Jailbreaking provides the user with access to the OS kernel, which could result in unintentional configuration changes or, at worst, open the mobile OS kernel up to malware infections.
Mobile Security
As with any computer or connected device, it is almost impossible to ensure 100% security, but there are some basic steps to take to keep your devices a bit safer. The goal of security is not preventing total access, but to complicate access for bad guys.
- Set a passcode on your phone
- Almost every smartphone comes with the ability to secure the login. This will require a code or biometric to open the screen and access apps, send texts or make phone calls.
- Double-check your apps
- Before you download an app investigate the app a bit, make sure it does not need access to unnecessary data (such as contacts, etc.)
- Review the apps you have installed to ensure you know what apps are on your phone and what access level they have.
- Be cautious about WiFi, I’m not advocating that you never connect to public Wi-Fi but be diligent about what networks you connect to and ensure that your phone is not set to automatically connect to networks you do not trust.
- Update
- Ensure you are updating your apps and operating system as often as you can.
- Backup your data
- It’s always good to have a backup plan. Google and Apple offer free and pay options for backing up your data in their cloud.
