Study into the Implications of Smartphone Operating System Security

Study into the implications of Smartphone operating system security
Privacy controls
App reputational services
Android mobile security products operate in a similar fashion to their desktop cousins with
background processing, where the platform supports it, signature-file checking, regular
signature file updates (usually OTA) and checks on messaging, removable media, mobile
internet and mobile App installation and execution.
How effective are they?
There has been debate as to the effectiveness of mobile security apps but it all depends on
what you are trying to protect against.
Using a locate and wipe app to find a Smartphone after it has been lost and stolen and then
to wipe the data on it is a useful utility whether it is a native (part of the operating system) or
provided by a third party. Although there have been questions as to how effective these
services are and whether they are reliant on the SIM card still being present in the device for
location purposes – Note: one of the first things that a phone thief may do is to pull out the
SIM card from the device and to disable the WiFi services.
The fiercest debate has been around the effectiveness of anti-malware on the device.
Executives at Apple and Google have long criticised the anti-virus industry stating that the
security of the operating system and ecosystem is more effective at preventing the spread of
malicious code.
The security vendors themselves will admit that there are problems in running anti-malware
services on the Smartphone. In an interview with Rapid 7, a security vendor, their CEO and
Founder Giri Sreenivas stated that there is a “weakness in mobile anti-malware products in
that they cannot be run in a privileged state on the device restricting their ability to detect all
malware and vulnerabilities”.
A further problem is with the limited battery life of Smartphones. Lookout Mobile Security’s
CTO and Co-Founder, Kevin Mahaffey, told Goode Intelligence that “Smartphone battery life
is an issue for us as it prevents us from continuously checking for Malware. We don’t want to
drain the battery so we have to resort to other techniques such as scanning for Malware
when a user downloads or updates an App”.
The German-based independent anti-virus test organisation, AV Test, have been testing
Android anti-malware products and their recent study of 22 products was published in
January 2013 93 . The good news is that only one of the products failed the test and did not
receive the AV Test certificate. The products are tested for protection usability and additional
security functions. Top points were awarded to products from TrustGo, Lookout, Symantec
and Trend Micro.
93 The full test results can be found here (http://www.av-test.org/fileadmin/pdf/avtest_2013-
01_android_testreport_english.pdf) in PDF format from the AV Test website
Goode Intelligence © 2013 P a g e | 94 www.goodeintelligence.com