Mobile Security: Camelot And The Wild West

The only secure device is one that is not connected to a network. However, this more or less defeats the purpose of mobile devices. Especially with the onset of social media and cloud computing, users are no longer just browsing the internet. As mobile devices become the primary platform for users, so will hackers' attention.

Just last month Google pushed the "Android Market Security Tool" onto at least 256,000 infected devices to remove apps with DroidDream malware, first reported by the Android Police. DroidDream was published within seemingly legitimate apps on the Android Marketplace which, once installed on Androids prior to 2.2.2, could obtain personal information as well as download additional code to run. The 58 apps infected with the malware were removed from the marketplace within minutes.

As with desktops, mobile malware can come in the form of anything from fake antivirus to "phishing" apps (apps posing as trusted banks or businesses), and they can be contracted through messages, app marketplaces, third-party marketplaces, and yes, even through the web browser. And this isn't just the case for Android. Even the iPhone has its own bout of security issues. Then, why is there so much hype regarding Android security?

The iPhone and Android exist in different worlds. The first is like Camelot, the second like the Wild West. On the iPhone platform, the operating system itself is tightly controlled and the App Store has strict regulations and screening. iOS users are looked after and protected by the "castle guards" at Apple. Exploits for iPhone are available only to very careless and those who install third party applications. The OS offers various encryption features and any known security holes in the OS are fixed and made available for users to easily upgrade upon syncing with their computer.

The Android platform is open source and there is little marketplace oversight. Users must lookout for themselves and the unguarded are vulnerable to exploit. There remains no built-in encryption available to apps, hence Skype's recent upgrade. That said, the lack of cooperation between carriers and Google to provide updates for the OS only compounds the issue, as this article discusses. Google has made security patches to its OS, but carriers have been unwilling to push the upgrades to its phones.

Both users and enterprises alike should realize the vast differences in the Android and iPhone environments. Be sure to confirm the authenticity of an app before installing, browse only trustworthy sites, and, as much as possible, keep devices upgraded.