How safe is android compared to other mobile platforms?

Question

Recently I get the impression malware is only present on Android (compared to other mobile platforms) as every IT news magazine reports only on Android malware. (I guess it is also involved with the fact that mobil devices become more and more powerful and also mobile malware evolves => kind of populism) However, when I do web search indeed I get the impression that Android is the excellent platform for malware:

• http://www.wired.com/gadgetlab/2011/08/android-malware-explodes-ios-remains-safe/
• http://www.pcworld.com/article/245380/ios_safer_from_malware_than_android_security_firm_says.html

What do you think? Are those ratings biased?, Why? On the other hand Android is the most common mobile operating system making it an attractive place for malware. Additionally manufactors do not update their devices with newer versions (as they want to sell newer phones with newer android versions (fragmentation)). And last but not least the android market is some how not as restrictive as the iOS store, right?

<edit> And yes of course: classifying what actually is malware is not so clear, so it depends how and who is calculating "malware". </edit>

Answer 1

This is too big for a comment, so here goes:

• Both articles cite one and the same McAfee report.
• McAfee is a security products vendor, hardly an impartial observer to the malware scene.
• McAfee does not have products which for iOS devices, but they most certainly do for Android devices. And paid, too. Turns out they might have for both platforms. I can't be bothered to install iTunes to verify.
• Android is the fastest-growing mobile platform, and with an absolutely crazy 73%+ growth rate, and now has 48% market share, compared to just 10% in the beginning of 2010.

No big surprise here -- this is just a marketing ploy by a security vendor to sell more products. The same trick they pulled off with other AV vendors that they did with PCs in the mid-2000s.

As an aside, security is not all that much platform-dependent as it is people-dependent. Most of the largest security breaches are caused by social engineering attacks rather than technical limitations. I have yet to see with my eyes an Android malware application, it has always been beyond me how people manage to get infected. See also this related question on whether you need AV on your Android (short answer -- no).

Your phone should be secure as long as you use common sense while installing and using applications. Don't trust anything that's on the Market Play Store, the same way as you wouldn't trust a random PC program, or a Facebook "app" for that matter.

iOS and Anrdoid security concerns pop here and there in the news occasionally, but from observing both markets for some time I'm fairly convinced that both platforms offer reasonable (technical) protection to their users, and offending applications are removed with short notice. Google has even removed malware applications from devices without user discretion at least once.

Answer 2

As far as the safety of Android, it depends a little more on the user. iOs has a vetting process for their apps, so it is very hard for malware to get onto the app store. With Android, it is much easier to put an app on the Market. Also, if the phone is configured to install from unknown sources, you can install software from anywhere.

However, if someone is smart about the aps they install, it is not an issue. Restrict app installation to the Google Play/Market store and the Amazon App Store, or other trusted software companies. When you install from the Google Play/Market, look at the number of downloads and the ratings - these provide an indication of how much you can trust the app.

Answer 3

You must distinguish security between

• programming errors that make a system less secure (as in the article your referenced) and
• the security-architecture.

I am only writinge about security-architecture.

Android has a sandbox that shields the apps from each other and from sensitive os-features.

On installation an android-app requires permissions to sensitive issues: access internet, files, adressbook, ......

If the running app tries to access some sensitive api whre there are no permissions the app is aboarted.

On unrooted devices the os does not allow to write to os-files. One app cannot access other apps' private files.

This is a good starting point for security.

However there is no fine grained security:

example: either an android app is allowed to access all internet or internet is not allowed. you can not restrict an android app to access only a certain url. there is no way that you can specify "ask me every time the app wants to access the internet."

the same applies to other sensitive issues as well: contacts, making sms-calls, accessing public folders in the filesystem, ....

So as long there is no "allow on demand" feature in the os and no more fine grained security-settings for me android up to version 4 is not secure enough. But as an open source system it has the potential to become more secure over time.

Comparison to other mobile os.

The dotnet-platform of Windows Mobile 6 and its predecessors down to ppc2003 also has a sandbox and much finer grained security settings. I am not shure how effective these are and if security modell still exists in the current system.

I have an old motorola java-me phone that is quite secure because the manufacturer does not allow other apps to access sensitive functions as long as the app is not signed by motorola itself or one of its trust partners. There is no setting that allows me as the phone owner to disable this security. However other java-me-phone vendors have this option.