Study into the Implications of Smartphone Operating System Security

Study into the implications of Smartphone operating system security
The figures from security vendors operating in the anti-virus sector rarely rarely give an
indication on actual infection rates, e.g. how many Smartphone are actually being infected
by malware. A study by Georgia Tech University in the USA that used a machine learning
technique called Multiple Correspondence Analysis (MCA) in an attempt to get to a “ground
truth” about how pervasive mobile malware found “little evidence of significant malware
infection in the mobile world.” 74
It is Goode Intelligence’s belief that allthough mobile malware is effecting UK Smartphone
users, the numbers of UK Smartphone’s that have been infected remian low.
Apple iOS
According to Symantec’s Darren Gale “Apple is getting proactive in its vulnerability
management approach”.
Goode Intelligence believes that Apple does offer a comprehensive approach to vulnerability
management that is linked to an effective operating system security update process.
Goode Intelligence discovered 179 unique CVE entries whilst performing a search on ‘Apple
iOS’ on the CVE vulnerability database. The latest CVE entry (CVE-2013-0974) was added
on 10 January 2013 and was related to an iOS Safari vulnerability. 75 The first vulnerability
(CVE-2010-1387) was recorded in April 2010 for vulnerability in JavaScriptCore in WebKit
on iOS devices pre-version 4.
Apple has stated that it does not offer any large bounties to security researchers for
disclosing iOS vulnerabilities. Other vendors, including Google, do offer a bounty scheme
whereby cash will be offered in return for disclosing vulnerabilities to them.
To report a security issue or vulnerability to Apple a generic email address, productsecurity@apple.com
is used. The emails can be encrypted using Apple’s product security
PGP key.
Apple product security notifications are sent out via email, using the ‘security-announce’
mailing list, or via a RSS feed
To ensure that Apple security advisories are authentic Apple uses an ‘Apple Product
Security PGP key’ to encrypt and sign.
Apple works with the formal incident response community to distribute information on
vulnerabilities and is a member of FIRST.
Apple lists all of its platform (not just iOS) security updates on a central website that can be
found here.
There are no security specific Apple iOS software updates but many releases will have fixes
to known security vulnerabilities. For instance, in the recent iOS 6.1 release there were
74 RSA Blog: Detecting Mobile Malware - http://blogs.rsa.com/detecting-mobile-malware/
75 You can find the CVE entry here: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0974
Goode Intelligence © 2013 P a g e | 82 www.goodeintelligence.com