The best mobile OS: security showdown
Smartphone security is fraught with peril. So few casual users realise they're carrying a complete personal computer in their pocket — one that's designed to connect to networks and transfer more data than their PC ever does.
Some commentators say that mobile vendors themselves aren't taking security seriously. Electronic Frontier Foundation technology director Chris Palmer, who was also a former Android security framework engineer, said in a January 2011 blog post that mobile systems "lag far behind the established industry standard" for security.
But some might lag farther behind than others. Today, five mobile operating systems dominate the market. We've done the heavy lifting for you by looking at the advantages and disadvantages of each OS, and then ranking the systems from best to worst.
Apple iOS
Apple's mobile device OS has grown faster than any competitor has ever managed. Announced in early 2007 for the then-forthcoming iPhone, it was ported to the iPod Touch soon after the SDK (software development kit) was released to developers in 2008, and then it stretched its wings on the iPad in April 2010. From day one, it's actually been a mini version of OS X, built on the same technologies like UNIX, Darwin and Cocoa.
Sheer popularity is the biggest security threat to Apple's iOS. While introducing the iPad 2 recently, Apple announced it had sold 100 million iPhones — that's a lot of credit card numbers to skim and address books to hack. Stories about hacks and vulnerabilities were appearing as far back as the original iPhone release, including the scary iPhone SMS bug, where SMSes were sent to a phone that gave the sender complete control over the device. That was on top of the security flaws that came out of the box, such as the ability to make calls and view contacts on a locked phone using a certain sequence of actions. It hasn't helped the iPhone's security profile that Apple has often been criticised for delaying patches.
Despite these issues, it's still a very close second to BlackBerry for several reasons. The first is its app delivery method, which is carefully vetted by Apple itself.
"Apps can usually only get onto the iPhone via iTunes," says John deGlavina, who's been involved in mobile development for eight years and runs cellphoneforums.net. "This alone makes viruses and other malicious software more unlikely than some other OSes."
Secondly, Apple introduced Microsoft Exchange ActiveSync in 2008, which allows the synching of content to an Exchange Server, and lets an admin remote lock or wipe the handset. In fact, it's been part of Apple's big push for the business market. Recent iPhone business support has included data encryption, device policies, secure VPN via SSL and WPA2 Wi-Fi, says deGlavina.
There's also better security at the handset level — a lesser-known fact about the iPhone is that after 10 incorrect tries at the unlock password, stored data is erased.
Of course, there's one huge caveat: early adopters and savvy users frequently circumvent Apple's strict quality control approach to app approval by jailbreaking their iPhone. It allows access to any tool or trinket you can find, no matter how dubious its origin, but it means that when it comes to security, all bets are off.
Android
Android is like the web in 1994 — pure architecture just waiting for developers, entrepreneurs and users to decide what they want, what they'll pay for and what it will do. Marc Maifrett, a former black hat hacker who woke up at age 17 with an FBI agent pointing a gun to his head, and who now runs eEye Digital Security, says, "This is definitely the hacker fan favorite. It's seen more real-world attacks than any other."
Before Google bought it, Android was built to know where you are and what you like, putting the two together seamlessly. It suited Google's mission of putting local information at our fingertips perfectly, and there's already been eight major updates. (Apple names its OSes after big cats, Android names its after sweet treats; Ice Cream Sandwich is due some time soon.)
The twin pillars of threat facing Android users are the open-source architecture and the large amount of data gathered on the user, the latter not always consciously; many apps use location-based data and exchange a lot of information that you might not even be aware of.
Google has pulled bad apps from the Android Market, but the Android marketplace isn't like iTunes or the BlackBerry App Store. Although the default setting only lets you download from the official Android channel, it's easily disabled. Plus, even though the system will ask you to confirm that it can access certain functions, it's a little like the User Account Controls that plagued Windows Vista. After being asked ad nauseam if you really want to do this, most users are likely to glaze over and just agree to everything.
According to Clint Adams, director of technology and product engineering at US Mobility-as-a-Service provider Fiberlink, Android belongs on the bottom of the mobile security heap simply because it hasn't been built with security in mind. "Android is adding security capabilities at a snail's pace," he says. "The problem is it's heavily influenced by carriers more interested in making money in the consumer market than enhancing the enterprise posture of their devices."
Yet, ironically, the openness might also be Android's saving grace. As Maifrett adds, "Google's openness is making it more straightforward to develop new ways of compromising devices, but the same openness means third parties can build applications to secure Android devices in a way that really isn't possible on other platforms."
And because Android market share is climbing so fast, security vendors are taking it seriously and adding Android protection to their product offerings. There are also signs that Google is beefing up its security profile to entice enterprise to have a closer look. In early April it added some handy native security apps; one pinpoints the location of a lost device, calls and resets it remotely, and another gives app admins the ability to encrypt device data.
But after-market or add-on apps raise another point about security. As Brian Reed, chief marketing officer of mobile service management provider Boxtone, cautions, serious encryption and security policy should be part of the underlying code. "There's no way to add device-wide encryption and lockdown control that is loaded after the device boots up that can't be cracked," he says. "You can try to add third-party agents with encryption or management software, but for a non-encrypted mobile OS that has no native policy management capabilities, a smart hacker can still get around it. Don't let an after-market vendor fool you — policy management should be built into the OS."
BlackBerry OS
Research In Motion (RIM) developed the BlackBerry OS, the second-oldest system on this list, in-house to put on their zeitgeist-capturing devices in the late '90s, but it wasn't until the launch of the BlackBerry itself in 2002 that the mobile data movement began. In the early noughties, as the BlackBerry became synonymous with push email, only know-it-now business types felt the need to receive emails on the train, at meetings or in bed.
Many organisations — including the White House — that invested in BlackBerrys for staff also deployed server management like the BlackBerry Enterprise Server to monitor and secure the network data and control data, and a slew of security features have evolved out of it. Just like Apple, RIM's software is a tightly run ship because it's programmed for the hardware it runs on. Fiberlink's Adams explains further.
"There's no question BlackBerry is the gold standard. The architecture is built from the ground up for security — it includes military-grade encryption, and has the most robust security and management platform available."
The enterprise-level features allow a centralised network admin to set and push security policies out to the whole fleet, which means that if a handset is lost or stolen, the admin can remotely lock or wipe it as soon as it happens.
Because the corporate end of the market isn't really the demographic for Angry Birds, pretty wallpapers or fart buttons, the BlackBerry App Store is also more known for productivity and business utilities, and is not nearly as large as its better-known rivals. Apps must also adhere to a stricter application programming interface (API) than in the open-source worlds of Linux or Android, and they're delivered through BlackBerry App World interfaces on the phone, dedicated software or the App World website, so there's less chance of downloading something nasty. Software that uses certain functions must also be digitally signed.
"There've been few real vulnerabilities, and the tools to secure the devices can easily address most of them," says Adams.
BlackBerry further increased its security profile in late April 2011 by launching BlackBerry Protect in Australia and New Zealand, an app that lets you backup, restore and locate your handset wirelessly.
Yet, there's hope for those who want to harness BlackBerry but love other devices. BlackBerry Enterprise Server will, in the future, also be able to support iPhone and Android smartphones and tablets.
Symbian
The Old Faithful of mobile telecommunications software, Symbian in the '90s was in the same position as Windows XP in the desktop PC market — it was everywhere. Its roots stretched back much farther, originating out of the EPOC PDA operating system of the 1980s and rebranded Symbian for the first release on the Nokia 9210 in 2001.
Joined inextricably at the hip with Nokia, Symbian became the de facto standard until the smartphone era. In the first quarter of 2003, it was shipped 1 million times. By the end of the year, vendors were selling that many Symbian-powered devices every month.
What does that have to do with Symbian's security profile today? Quite simply, early adopters and geeks are only a tiny slice of the market — there's still a hell of a lot of Symbian phones out there. Despite market share dropping from its historic high of over 70 per cent, it has a commanding lead of 37.6 per cent (as of late 2010) over the nearest competitor, Android (with 22.7 per cent).
In 2005, after three major releases, Symbian began the transition to open source with Symbian 9. It released the API to third-party developers, but beefed up platform security by making the developers apply digital signatures to their products. The move hasn't stopped the drop in new purchases of Symbian devices, however; and the Ovi store is seen as a poor cousin to the Apple and Android stores. For that reason, there aren't nearly as many buggy apps being bandied about, and the threat landscape is consequently low.
Throughout the early noughties Symbian helped usher in the mass adoption of the SMS. Fiberlink's Adams says that this helped to consolidate its security profile against the few vulnerabilities it encountered. "Symbian offers robust Exchange/ActiveSync integration and policy support, which helps secure the device for its most common-use case, messaging," he says.
Symbian supports the Open Mobile Alliance (OMA) Device Management (DM) specification, which allows IT managers to remotely protect data on the devices, configure devices and manage applications. Remote locking for the user is simply a matter of sending an SMS with a code, which locks the phone. A confirmation "phone locked" SMS will follow.
Despite Symbian's widespread nature, the rise of Apple and Android has placed an axe over its head. A lot of blogs and developers will tell you that it's been discontinued, especially in light of Nokia signing a deal to make Windows Phone 7 its primary smartphone OS in future. Nokia has stressed its continued support, expecting to sell "approximately 150 million" Symbian devices in years to come. Yet it added: "We are realistic and understand that [the Windows Phone 7] transition will result in a significant reduction of our investment in Symbian and eventually lead to Symbian being displaced by Windows Phone at some point."
Windows Phone 7
If the popularity of a system is the biggest threat indicator, Windows Phone 7 might be the safest so far, with few users and little initial action despite several major handset makers such as HTC, Samsung and LG hitching their wagons to the OS, and Nokia announcing a major partnership based on the operating system.
The friendly new interface was released in late 2010. With its large home screen buttons ("tiles") and easy-to-read screen fonts it's the first major update to the Windows Phone world in a long time, with the previous Windows Mobile OS applications not supported.
When it comes to security, that might be a good thing, as any vulnerabilities (such as the auto-diallers found in repackaged applications in early 2010) might be stopped dead in their tracks, especially since, as with iTunes for the iPhone, applications can only be sourced from the Windows Phone Marketplace instead of the dank corners of the web. Once the apps get onto the phone, they run, like Android and iPhone, in a sandbox with isolated runtime and storage architecture.
However, the underlying OS isn't a brand new architecture. Former hacker Maiffret explains that Windows Phone 7 is partly the sum of its predecessors' parts and shares some of their security vulnerabilities.
"Windows Phone 7 is based on components from both Windows CE 6.0 R3 and the upcoming Windows CE 7.0. The rewrite was just the overall GUI, which was based on the metro interface (which is in turn from the Zune player). It's based on a newer version of CE but it's still CE."
But without even needing to have an enterprise software deployment to back your device up, a big plus is the ability to remote wipe a lost or stolen Windows Phone 7 handset through Windows Phone Live. And, in a neat trick, Internet Explorer for Mobile has a feature that ensures that malicious code can't be launched from a website.
If you do have an enterprise or Exchange setup for a mobile fleet, there's a solid security toolset for admins that includes requiring a password, password strength policies and reset to factory defaults after a certain number of failed attempts. But the jury's still out on enterprise-level security, as Fiberlink's Adams explains. "It doesn't seem to have been built with security in mind, and it's not clear if it'll support full device encryption, and that'll stop a lot of enterprise adoption."
The verdict
| Operating system | The good | The bad | The bottom line |
|---|---|---|---|
| 1. BlackBerry |
|
| Solid. The business-oriented choice. |
| 2. Apple iOS |
|
| Not bad for an OS that's loved by the young and old. |
| 3. Windows Phone 7 |
|
| Early days, but history counts against it. |
| 4. Symbian |
|
| On the way out, but still strong. |
| 5. Android |
|
| Undisciplined app landscape, but huge security potential. |
(Image credits: Apple, RIM, HTC, LG, Nokia, Google, Windows)