Malware targeting Android made up 63% of all mobile malware in the second quarter of 2011, according to Security Mobile Devices: Present and Future.
Igor Muttik, McAfee researcher and author of the white paper, cautioned against comparing the security of operating systems alone. He said that the iOS and Android are comparable in terms of security, but the reactive approach of the Android Market to malware, rather than the proactive approach of Apple’s App Store, creates more opportunities for malware writers.
“People tend to compare security of operating systems and security of individual phones, but what really should be done is comparing the entire set of security features environment, which includes the hardware, the software, and the marketplace, and to some extent the mobile service provider and OEM for the phone”, Muttik told Infosecurity.
“The entire infrastructure and environment around the device makes the security of that device very different, depending on how it is implemented and how it is managed”, he said.
Muttik noted that for the iPhone, the same company manufactures the phone, installs the software, and managers the applications store. However, with Android, there are a number of OEMs that manufacture the phones, and they frequently modify the operating system to include additional features. “It’s a risky process. If some bug is introduced in how devices are updated, the entire operating system can be compromised by a piece of malware”, he commented.
Google has attempted to improve security with the Android Ice Cream Sandwich, also known as Android 4.0, but it has not been available long enough to judge whether it is being effective, Muttik said. Launched in October, Android 4.0 includes a unified interface for phones and tablets – as well as a number of significant new technical features, including native facial detection.
In its conclusion, the white paper predicts massive attacks on mobile app stores “that will start with simple malware posts and gradually involve manipulating developers’ reputations and infiltrating app source-control systems.”