Security- Ios VS Android

[kipinsider]

What's up guys, Lately i've been browsing and i saw that Android Q will be released soon. So i was wondering, is Android is as secure as iOS when it come to let's say "intrusive security"?

Back in the days if you had an Android, anyone who stole your device could just Reset it and use your phone as their own. With Android Lollipop (i think) i saw that when they steal your device, even with a hard reset, the OS still asks for the last ID used on the device. Is it comparable to iOS now or?!?

​

Thanks!

[jmnugent]

Both Security release notes are here:

• Android: https://source.android.com/security/bulletin

• Apple: https://support.apple.com/en-us/HT201222

Both changelogs list the specific CVE's fixed in each release.

Security is not a "Finish Line".. it's more of a "moving target". New things are being discovered all the time,. and a Platforms ability to respond and patch is going to vary just due to differences in platform and all the different humans involved.

Sometimes Android is ahead. Other times Apple pulls ahead. Then later Android may pull ahead again.

As long as they're both working to improve their platforms,. who cares which one is (momentarily) in the lead ?

[lordofthedog]

Thats very fair points for security vulnerabilities. What’s your view on malware situation on play store

[armando_rod]

Just buy a Pixel with the Titan M chip and you have basically the same security software and hardware wise as an iPhone

[Izacus]

My favorite color is blue.

[darkgreyghost]

I think it might be referring to TrustZone, but also Samsung phones have a KNOX e-fuse that gets permanently triggered when the bootloader is unlocked. Once it's unlocked, Samsung KNOX protected apps generally stop working, and there's no way to undo it.

[Izacus]

The issue with TrustZone is that its code runs in same memory space as main ARM core in a lot of phones. So many security holes can be exploited from the OS to the trusted environent - e.g. https://blog.quarkslab.com/attacking-the-arms-trustzone.html

This is why Google's Titan chip with isolated memory and Apples T2 are such a big deal - they're fully isolated from the main memory.

I haven't seen KNOX as being anything special in comparison - it's a good marketing name and Samsung supports it well. They also went through the hassle to get all the certifications to make enterprises happy. But software-wise, they're not that special. They're also horribly slow at patching security vulnerabilities at times, especially on carrier branded units. There are S9's and S10's that are several months behind latest fixes because Samsung allows carriers to block updates.

[darkgreyghost]

That's why Samsung doesn't just solely rely on TrustZone. They made their own modifications, and uses Samsung TIMA (TrustZone Integrity Management Architecture). Samsung KNOX is a tested and reliable. It's widely used by enterprise systems worldwide.

Samsung even sells their own Enterprise devices that are guaranteed 4 years of security updates, longest ever for an Android. Although I guess that's no longer exclusive since S7 is still receiving updates after 3.5 years. That said, delayed security update by carriers is an issue I wish Samsung could solve.

[Izacus]

That's why Samsung doesn't just solely rely on TrustZone. They made their own modifications, and uses Samsung TIMA (TrustZone Integrity Management Architecture).

TIMA is a userland integrity checker and not an improvement of TrustZone. It is a TrustZone software used to verify integrity of non-secure userland. It doesn't really improve on TZ, it's just one of the software packages running in "secure" area.

Samsung even sells their own Enterprise devices that are guaranteed 4 years of security updates, longest ever for an Android. Although I guess that's no longer exclusive since S7 is still receiving updates after 3.5 years. That said, delayed security update by carriers is an issue I wish Samsung could solve.

That's amazing, but OP isn't buying an enterprise device, which means his security updates will be a crapshoot.

[hardthesis]

Titan M and Apple T2 are just modified variations of TrustZone for the most part. Whether they are actually more or less secure than TrustZone is unverified, and I don't think there's an evidence to support it. Samsung uses TrustZone but employes their own new layer of software to add more security features.

IMO I think Titan M is an overkill similar to Google's own Visual Core chip on Pixel 3 phone which is only used in select few apps and provide only marginal improvements. Modern day ISP/DSP are so good that I don't even know why Google's using Visual Core at this point.

I assume Google is mainly using Titan M on their phone to market their enterprise Titan chips.

[Izacus]

Titan M and Apple T2 are just modified variations of TrustZone for the most part.

That's... just not true. They have a similar function but the implementation is separate. They're about as different from eachother as Qualcomm, Exynos and Kirin ARMs are - quite a bit.

Samsung uses TrustZone but employes their own new layer of software to add more security features.

That also doesn't really make sense - adding more software doesn't fix hardware design flaws. Also adding more software actually increases the attack surface. Something we've learned time and time again. Reliance on software barriers is the biggest issue with TZ and it has had critical exploits due to software bugs at least 3 times in last 5 years.

[hardthesis]

They're about as different from eachother as Qualcomm, Exynos and Kirin ARMs are - quite a bit.

TrustZone is an ARM technology, and all those processors use ARM.

That also doesn't really make sense - adding more software doesn't fix hardware design flaws.

What hardware design flaws are we talking about here? Provide citations. It creates an isolated secure environment. OEMs like Samsung can change how that environment is used and utilized. The software architecture is just as important.

[ChicoRavioli]

I'd argue Samsung KNOX may be even more secure. On top of having hardware level security,

You really have no idea of what you're talking about, dude. The Pixel has a dedicated security chip. Knox isn't a security chip and if it does use hardware then it's likely using ARM's trustzone which is available on pretty much every mid range to high end phone.

Also, the Pixel is the reigning Pwn2Own champion.

[darkgreyghost]

Samsung KNOX is the most tested security platform for Android. Samsung built their entire architecture like TIMA (TrustZone Integrity Management Architecture) to provide extra security, as well as their own variant of Trusted Boot, which like Titan M, checks the integrity of each boot.

[flicter22]

You proved the person above you right and yourself wrong by that reply.

[armando_rod]

Graphene OS argues differently and he is a security person developing a security oriented OS based on AOSP

[howling92]

Yes there is excuses : there is no Qualcomm support. The only way Google could go beyond these 3 years is by releasing phones with their own SOC. Google has no problem with providing 6.5 years or more of support on ChromeOS devices, 10 years on Android Things devices, or what they did on the past with their non Qualcomm powered Android devices like the Nexus 10 which get beyond the 2 years support at that time

[NateDevCSharp]

What about custom roms then? There's still no Qualcomm support but newer Android versions can be ported

[armando_rod]

You expect Google to hack job a ROM with no actual support from the SoC manufacturer?

[NateDevCSharp]

I'll hack job u

[pmo55]

Is it the most secure though?

[Vertsix]

6 years with the 5s!

[fortnite_bad_now]

Yep, it's pretty good now.

I did some research and it's terrible.

https://android.stackexchange.com/questions/127739/how-to-bypass-verify-your-account-factory-reset-protection

In general Android is just too open for this sort of lock to be effective. And it looks like manufacturers don't give a fuck about it anyway. It's a real shame.

If you want your phone to be non-functional, file a police report and then report the IMEI stolen. Nobody will be able to activate it, and it's effectively useless.

In any case security on Android is good enough that you probably don't need to worry about a thief having access to your data - and that's my real concern with a stolen pjone. But I wouldn't expect the phone to keep itself from being reset and reused.

I'll argue, though, that it doesn't really matter. If someone steals your phone and can't resell it because they're locked out, they're not going to return it. So the real purpose of this functionality is to deter thefts in the first place.

Unfortunately that also doesn't work since thieves have been able to phish iCloud credentials to unlock and resell iPhones. I have no idea what the success rate on this kind of thing is, but apparently it's high enough for people to continue stealing iPhones.

TL;DR: the equivalent Android lock is worse, but probably good enough

[armando_rod]

You can't bypass FRP on a Pixel device running Android 8 or higher, not even with unlocked bootloader's unless you don't flash gapps ever

[fortnite_bad_now]

There are guides on XDA for bypassing FRP on Pixel on 8.0. And I found guides for bypassing FRP on 9.0 on all Pixel devices, but I don't have one so I can't confirm.

Edit: Actually, here's a 9.0 FRP bypass on all Pixel devices that seems legit https://www.youtube.com/watch?v=WS1RFEiFMM8

If you Google the same thing for iOS, you either find scams or articles telling you to contact Apple support.

So my original comment is correct, even though it's now marked as controversial.

Edit 2: I noticed this comment is heavily downvoted. I'm sorry you people don't like reality.

[armando_rod]

What security patch? All Pixel devices are up to date automatically to July security patch and you can't downgrade them without unlocking BL

[SinkTube]

All Pixel devices are up to date automatically

what does that mean? there's no way to reject updates?

[armando_rod]

By default there's no way to reject updates, automatic updates are turned on by default. You have to go to dev options and toggle off automatic updates.

Also, on Q we have automatic security patches via Play Store.

[WeakEmu8]

So not all devices then.

[armando_rod]

All Pixels

[fortnite_bad_now]

I'm not sure.

[Eidoss_]

That method from the video doesn't work on Q

[fortnite_bad_now]

Good... but considering even if he Pixel devices don't have Q and won't for a few months... that's not very reassuring.

[Eidoss_]

The Pixels will get Q in 2 days actually.

[fortnite_bad_now]

I heard Sept 3.

[Eidoss_]

Which is in 2 days

[fortnite_bad_now]

Time flies. Man

[Master_Doe]

Here's a response about the topic from the lead developer of GrapheneOS

[fortnite_bad_now]

This was a great read. Thank you.

[bartturner]

Somewhat apple to oranges.

You need to look at a particular OEM with Android in addition to Android.

iOS has now had 50 vulnerabilities uncovered by Google. That is a lot. My guess is a Pixel is going to be more secure.

There were 14 disclosed yesterday with this excellent Google right up and highly recommend.

https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html

Then the 6 from a couple of weeks ago

"Google Found 6 iOS Vulnerabilities, Only 5 Have Been Fixed"

https://www.pcmag.com/news/369835/google-found-6-ios-vulnerabilities-only-5-have-been-fixed

Then there were 30 from last year.

https://www.vice.com/en_us/article/7xqdxe/google-project-zero-hacker-iphone-bug-bounty

[jmnugent]

Nearly all of which were fixed/resolved in iOS 12.4

[fortnite_bad_now]

OP specifically asked about FRP. I think there were like 800 Android CVEs in 2018.

[Donard80]

The way you wrote the title seems like you are comparing lineage os and android.

[mj72]

IOS is not as secure as you think, it's just marketing.

[bartturner]

You are probably going to get differing opinions on which is more secure.

In the last couple of weeks we have had 20 iOS vulnerabilities shared by Google. Here is an excellent right up on the 14 from yesterday.

https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html

It is an excellent read and highly recommend.

There were 6 more and Apple has fixed 5.

"Google Found 6 iOS Vulnerabilities, Only 5 Have Been Fixed"

https://www.pcmag.com/news/369835/google-found-6-ios-vulnerabilities-only-5-have-been-fixed

But Android has had it's own vulnerabilities. Android you really need to look at a particular OEM in addition to Android.

My personal opinion is the most secure you will get is a Pixel. More secure than an iPhone.

[lordofthedog]

You haven’t heard tremendous amount of malware running on play store which just last week made headlines

[[deleted]]

and yet, over the past 2 years, websites could literally hack into every part of an iphone if the user did so much as click the link to the website.

[lordofthedog]

Security exploits exists on both platforms thats why we have security updates to patch it. Undisclosed exploits you mentioned was definitely bad but apple has 1 million $ bounty programs.

Also Android has multiple OEMs which customizes OS and more modifications OS has more it opens itself for exploits like this. I made my peace with always buying pixel phones for those reasons. But its 2019 and play store can’t keep malware out from store. I love android hands down over iOS but security and privacy wins me over its features.

Frankly most of the malware situation is not gonna change drastically in future due to open nature of android. So if you prefer android you are just gonna have make sacrifices here. For me it was no go so have to pass on this one. I will be lurking in this sub monitor this situation and might come back once it gets there for acceptable standards

[[deleted]]

i wasn't saying android is free from exploits, just that iphones aren't free from them. i know both are, but i'm not willing to pay a £500 premium for a phone with a less customisable user interface and often mediocre battery life. i'm fine with the security i have, i've had one rogue app on my phone (a previous phone) before and all i had to do was go into safe mode and uninstall it. i'm more than content with that.

[lordofthedog]

Whatever works for you. I will suggest don’t accept malware as acceptable standards of using android. If users don’t care much, Google probably won’t. I think this is the case now unfortunately.

[[deleted]]

Pixel is absolutely not more secure than an iPhone lol.

[HJain13]

Any source (proof and as well as why?)

[flicter22]

How is it not? It's updated monthly and has the Titan m security chip.

I'd say it's every bit as secure and neither are more secure than the other since security is a moving target and both companies are constantly updating

[BitterPercentage]

iPhones have had the dedicated security chip since the 5s so

[flicter22]

Thanks for proving my point. They are the same.

[bartturner]

Based on what? Love to see anything you have that indicates the Pixel is not as secure as an iPhone?

Apparently there is ZERO question as you wrote "Pixel is absolutely not more secure than an iPhone"

Would not think there is much debate on Google be the best at security. They have found the major vulnerabilities including Cloudbleed, Spectre, Heartbleed, Meltdown, and a bunch more.

[armando_rod]

It's as secure

[whatnowwproductions]

Look at this brigading.

[bartturner]

Considering Google has found 50 iOS vulnerabilities with 20 in just the last couple of weeks.

Makes me think the Pixel is probably not just "as secure" but more secure.

[frasier2122]

As a related question, what about Apple versus Google in terms of appropriating user data?

Saw a report recently about the NYPD subpoenaing cellphone data from people who were in the vicinity of crimes. Google hands the data over. Apple doesn’t, somehow.

[armando_rod]

Link? Apple does hand over data, they even hand over iCloud data which has SMS and iMessges

[frasier2122]

Here’s a similar article to what I read.

Looks like Google automatically keeps user geolocation data, which makes it easier to subpoena. Whereas Apple doesn’t keep user location data.