The article leads off with this:
In a new Apple ad, a thief breaks into “your phone” but struggles to get into an iPhone. Here’s how it plays out in the real world.
I was all set to read about how the ad was wrong, that Android phones were actually just as safe. But:
There are several reasons why iPhones are more secure than the various phones running Android software, according to Mike Johnson, who runs the security technologies graduate program at the University of Minnesota.
Side note: That’s no small-time opinion. The University of Minnesota has one of the best computer science programs in the US.
Moving on:
The old rule about PC viruses seems to be holding true with mobile phones, as well. Android phones make up more than 80% of the global smartphone market, and hackers are more likely to succeed if they write programs for these devices, just because of sheer numbers.
The Windows vs Mac logic. Certainly true.
Plus, he says, the process of “patching” security holes is easier on iOS devices. Apple’s iOS operating system only runs on iPhones, while Alphabet’s Android software runs on phones made by numerous manufacturers. It’s more complicated to deliver patches, or bug fixes, that work across so many device makers and carriers. Android can release a patch, but it won’t necessarily be available on all devices right away.
“Fragmentation is the enemy of security,” Johnson says.
And:
Last year, Wired magazine reported that one security firm was offering up to $1.5 million for the most serious iOS exploits and up to $200,000 for an Android one, a sign that iOS vulnerabilities are rarer.
Add to that Apple’s underlying review process, designed to restrict the use of private APIs, controlling techniques that could end-around Apple’s security processes. Not perfect, but world’s better than the more wild-west Android ecosystem.
Nope, this is the myth of “security by obscurity”. iOS devices are not more secure because there are fewer of them an Android devices. True there are fewer, but there are still millions and millions and millions of them — certainly enough to make it a tempting target to hackers. No, there are fewer successful attacks because it’s a harder platform. Period.
This is also why OS X has no viruses in the wild while Windows had tons. Proof? Even classic Mac OS had more actual viruses than OS X, despite having a much, much smaller install base than OS X enjoys today.
You’re overlooking the fact that thieves are lazy. If they weren’t, they’d be working security and earning white hat money. They go for the easiest targets using the most automated methods. For example, the WannaCry attack was massive, but sloppy. (Caveat: it’s possible ransom wasn’t the true purpose of the attack, but that’s another topic.)
Let’s not forget security’s twin brother privacy. That “thief” might just as easily be attempting to steal your data as actually invade your phone.
You are talking about much further down the line than where exploits are initially discovered and weaponized.
A weaponized iOS attack is worth much more money, and it’s not actually “easy” to break Android or Windows. It’s only easy to take advantage of someone else’s weaponized exploit.
Yeah, the “security by obscurity” argument is bullshit. We’ve seen crackers show off macOS and iOS exploits. There’s a lot of credibility and cash associated with them.
And it’s not like macOS and iOS are completely secure.
But they are harder to attack, and that’s not nothing.
With classic Mac OS prior to 7, all you had to do to infect a computer was insert a floppy disc. All you had to do to spread the infection was leave another floppy disc in the drive long enough for the virus to copy itself to it, and it even could hold the disc in the drive long enough to complete the write.
That also could explain why it’s more valuable for an iOS exploit independent of difficulty. If the expected return of an iOS exploit is 7.5x that of an Android exploit, then you would see the same price difference.
Also, a lot of the folks buying exploits are state actors. If more “important” people are on iOS than Android, the market will skew higher for iOS exploits.
You get a one up just for using the correct word “cracker”. 🙂
I think we’ve lost the hacker vs. cracker battle, but it doesn’t mean we can’t be correct. 🙂