Last week, I attended PC Magazine's SecurityWatch Summit about mobile device security. These are some random notes and thoughts from the meeting.
One reason that iOS is safer than Android is that bug fixes to the operating system are rolled out faster. Dan Guido, CEO and Co-Founder of security firm Trail of Bits, was, for example, impressed with the rollout of the 5.1 update to iOS 5. By and large, he said, Android fails miserably in this regard.
Although it didn't come up at the meeting there is a free app that reports on known, un-patched, privilege escalation flaws in the Android OS. The app is X-Ray from Duo Security. The screen shot below indicates there were no vulnerabilities on the tested device.
I ran X-Ray a few months back. The installation is non-standard and, at the time, the instructions were far from ideal. Still, it's a Defensive Computing thing to do.
In a recent blog, Jon Oberheide of Duo Security, wrote that anyone on Android 4.0.4 or later, should not have any of the flaws X-Ray looks for. He also noted that they were soon going to detect additional bugs.
Based on a sample of over 20,000 Android devices, Duo Security recently reportedthat about half contain known flaws. Sadly, there's nothing users can do, if a patch is not available, other than gripe about it.
Guido also pointed out that malicious Android apps that jailbreak a phone in order to break out of their sandbox, have all used old known bugs in the OS.
Gary Davis, VP of Global Consumer Marketing at McAfee said that they are starting to see ransomware on smartphones. They also see bad guys re-directing incoming SMS messages such that the victim never sees them. Later in the panel, it came out that this sort of thing is not possible on Apple devices because there is no available API for apps to get at SMS messages.
Davis also noted that malware can see the phone number being dialed and if its one for a credit card helpline, then it will record the call and listen for a sequence of numbers. After a demo of Wi-Fi hacking, he pointed out that Bluetooth is also vulnerable and advised turning off Bluetooth when you don't need it.
Renato Delatorre, the Director of Network Technology & Security at Verizon Wireless, reported that Verizon just released a free security app for Android called Verizon Mobile Security. The app contains two components from McAfee's Mobile Security product, antivirus and siteadvisor. A more full-featured version costs $2/month. The software is only available on Verizon phones.
Keith Gordon, SVP of Security, Identity and Fraud at Bank of America, said that online banking is safer on mobile. I wonder if he's played with a Chromebook?
For Internet access while traveling, you are safer using a 3G/4G mobile data network as opposed to Wi-Fi. I suspect there are multiple reasons for this but the only one offered at the meeting was that the equipment bad guys would need is more expensive.
On a related note, I use the mobile hotspot feature of my 3G Verizon Android phone as an occasional Internet provider for assorted Wi-Fi only devices. While it defaults to the strong WPA2 (AES) encryption, the SSID and password should both be changed from the defaults. Verizon offers no guidance about this when you sign up for the service (it costs $20/month for 3G phones), but these Wi-Fi parameters are easily configured from the main settings menu.
Guido pointed out that malicious software, so far, has gotten onto mobile devices via an app, rather than using the browser as its point of entry.
Speaking of apps, he also came down fairly hard on Google in a couple regards.
For one thing, because of the way Google validates apps, prior to their being made available in the Play Store, it is possible for an app to detect that it's being tested. Thus, an app to be well behaved when Google is watching and then be malicious after its installed. For more on this see Google Play: Android's Bouncer can be pwned.
Finally, in what I found to be the most important point of the night, there is almost no malware on iOS devices, in large part, because Apple knows who their developers are, whereas Google does not.
Bad guys, like roaches, like to hide in corners, and Apple makes that all but impossible. I spoke to Guido about this after the panel and he said that Apple demands incorporation papers for companies and a drivers license for an individual.
In an April article at Threatpost.com, Guido was quoted as saying: "Accountability, not superior technology, has kept Apple's iOS ecosystem free of viruses, even as the competing Android platform strains under the weight of repeated malicious code outbreaks ... It's not like there are fewer vulnerabilities in iOS."
Bad guys that submit malicous apps to Apple have to consider that there may be "real world punishment" in Guido's words. Contrasting this to the Play Store (formerly known as the Android market), he says that developers of Android apps
... must pay a small ($25) fee and agree to abide by the company's Developer Distribution Agreement to begin publishing. That's a low bar that makes it easy for malicious authors to get their wares out to hundreds of millions of Android users ... You can upload dozens of applications at once. If any get banned, you can just resign, sign up under a new identity and resubmit them ..."
For more on the meeting see Key takeaways from the SecurityWatch Summit 2012.
