Is possible to know if increased marketshare means more viruses?

Question

I'm having an argument with other developers about why more "viruses" exist (including all forms of external attacks, exploits, etc) in Android vs iOS. Like with Windows vs *nix, the main idea is that the bigger market share is the determinant factor in the increase of attack attempts.

I think that the main factor is how easy is carry a successful attack, i.e.: Windows have more viruses because it was a weaker target than others.

So:

1. More numbers (population) = more attacks or
2. More weak (security) = more attacks

I acknowledge that it is necessary that a sufficient # of targets with enough value must exist to sustain this behavior, but I think that it is possible to have a more secure system, no matter how popular and that the increase on numbers will not yield a increase in viruses.

However, that is my intuition. Does proof exist either way? Is there research about this?

Answer 1

Although there has been reported malware on both platforms (Anroid and iOS) I believe most of the Android malware can be attributed to the freedom given to the user regarding apk (app) installation and the vetting of apps prior to publishing.

On iOS Apple must approve all apps before they are published on the App Store. This process can take several weeks with much back and forth between the developer and Apple. For non jail broken phones this is the only source of apps. Although a few reported cases of malware has slipped through, this process increases the difficulty of publishing iOS malware. Put this on top of the fact that to register as an iOS developer Apple takes good care to get your business registration details. The level of effort is not insignificant for iOS malware.

However on Android it is easy to install apps from third parties. Apps on Google Play itself are only partially vetted (via Google Bouncer and a new client side malware check on 4.2 Jelly Bean for malicious behavior). It's easy to register on Google Play without official business documentation (for example Articles of Organization)

The vast majority of Android trojans are posted on third party app stores as free versions of some paid app. Even on Google Play a number of malware apks have been published and downloaded by hundreds before Google has taken them down. It's relatively easy to convince users that a pirated version of an app is just that, without injected malware.

I personally have seen push notifications telling the user they must download the "Official Android Update" after which the user is brought to a 3rd party site.

The bottom line is the freedom that Google gives its users to download whatever apps they want from wherever they want in addition to a less rigorous pre-publishing process for the Play Store makes the level of effort for publishing Android malware significantly less than iOS malware. So while numbers do play an important role "How can I get the most installed with the least amount of cost/effort" leads to Android being more popular for malware.

Answer 2

I´ve always felt that market share is often a boolean value - you either have "enough" or "not enough".

So, no-one's going to write malware targeting WebOS because the market share is "not enough", but both Android and IOS have "enough" market share that you can profit from malware.

The difference in malware activity, then, is down to the relative ease of distributing android malware.

Answer 3

If you are looking for a definitive proof of market share vs. security control effectiveness as the primary reason for a cause of hacking successes, I believe you are looking for something that is impossible to prove. The complexity of the question is too big for a single detailed proof for all cases, and in most cases, the data we can gather shows a correlation but not a causation. Add to it the unknown factor - any survey will only be able to consider the reported exploits - undiscovered or unreported attacks or exploits won't be known by the researcher, so won't be in the report.

There has certainly been a correlation between a product's growth in market share and the number of discovered successful exploits against it. It's not the same growth curve for every product, but one way this could be researched would be the growth in published vulnerabilities by a group like US-CERT for a given product. That's a pretty researchable trend with the common theory being that more market share --> more good targets to hack -> more hackers & hacking -> more exploits.

But what you are asking for is "causation" - from market share or poor security design to proliferation of successful exploits. While you may find a study that claims to have proved it, I'd be very wary as causation is pretty hard to demonstrate outside of a contrived test environment, and contriving the test for this would be pretty difficult (I'd love to be proved wrong...).

I will say that common research is showing a shift in the nature of hackers in the current time frame. When I started in security, hacking for the fun of it was a pretty significant force, and a major way of finding exploits. Those were the innovators, and "script kiddies" followed up with reusing found exploits for malicious purposes. So there was a reason to believe that if a product was big "enough" and interesting "enough", some smart people would come along and try to exploit it.

I'd say that today the field is different - major communities of hackers share hacks the way open source developers share code, and high end institutions worry about equally high end hackers who make serious strategic choices based on driving objectives that have nothing to do with either market share or weak security - and everything to do with politics, money and criminal activity.

in all cases, what hackers choose to hack is a choice based on the internal motivation of the hacker, not either of the two vectors you mention and that's going to be caused by larger social forces.

I'd offer that the difference between the two cases you're talking about has a lot to do with the nature of the hacker population. Different hacker communities are motivated by different drives. Some hack because it's fun, some hack because they want financial benefits for minimal work, some hack because they have a non-monetary sociological goal (a group protesting something, international cyberwar, etc). In all these cases, the hacker or group in question is going to choose a nexus of simplicity to hack and market share to fit their specific needs.