Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the likelihood of running malware on the device is much lower. And even if malware is running on the device, I assume it wouldn't have the same capabilities that desktop malware does, such as keylogging.

Furthermore, iOS Safari doesn't support plugins that would enable a man-in-the-browser attack. This means that drive-by malware installation through common vectors such as Java, Flash, and Adobe Reader should be impossible. It presents a user interface that clearly indicates whether or not a connection is secure, and that user interface cannot be overridden by the site being displayed.

Assumptions

  • iPhone has not been jailbroken.
  • The password is typed with the onscreen keyboard.

Extra credit

  • Does use of a password manager (like 1Password) improve or reduce security?
share|improve this question
    
If this is considered off-topic, just read "online commerce" as "line of business application". Basically, I want to know whether iOS is really a trusted platform for web apps. –  Nic Feb 2 '13 at 6:11
    
Found a very similar question: security.stackexchange.com/questions/23855/… –  Nic Feb 2 '13 at 16:37
    
The answer to this related question points out some vulnerabilities of mobile browsers. security.stackexchange.com/q/290/1092 –  Nic Feb 5 '13 at 21:35
    
This depends on the software and how it handles the cache files. There have been many cases on ALL the mobile platforms where the cache user data was not secured despite the author of the web application thinking it was. –  Ramhound Feb 6 '13 at 13:01

4 Answers 4

up vote 3 down vote accepted

If you are using an IOS mobile device, your device is subject to many attacks such as

  • Juice jacking
  • A web browser that doesn't show HTTPS status clearly (iPhone)
  • A web browser that doesn't show the URL... enabling phishing (iPhone)
  • Web browsers that don't support additional SSL/TLS validation software such as Convergence

If you must use a mobile device, I'd suggest using a dedicated application, as this post suggests. In addition, the application itself may also validate the HTTPS certificate key (preventing MITM attacks) or even better it may use mutual auth TLS

(The following is similar to @Rory's answer:)

The ideal solution, is to reformat your PC, and install a virtual OS for games, testing, etc. Then use the standard PC for all your banking needs. Since the VM can't access your PC (hopefully you configured it so) then you're safe from any phishing or other attack.*

* Exception

share|improve this answer

The Apple walled garden model and iOS security model are very good for protecting the host but web applications require more than host security.

The iOS-ification of Mac OS X has brought the option of allowing only signed and vetted apps from the Appstore and the mandatory use of sandboxing from March 2012 on.

Windows 8 is slowly following the same model by making the tablet version (Windows RT) only run code from the Windows Store by default. But the platform is still young and fragile.

Apple Appstore security:

  • $99 joining fee.
  • Checks your identity and uses crime enforcement.
  • Content review and static analysis.
  • Code is signed and cannot be modified.
  • Cost to exploit is very high.
  • Very few malware applications slip through.

Apple iOS security:

  • It takes 6 months to write an exploit.
  • App review is a risk for months of work on an exploit.
  • iOS exploits are written by few groups.
  • Apple patches fast.
  • Code signing is employed, memory pages are signed at runtime and like DEP it protects against injecting code.
  • iOS Seatbelt sandbox is very good.
  • Charlie Miller injected new code at runtime by finding a vulnerability and got banned from the Appstore then the vulnerability was patched in 4 days.
  • Few malicious use of vulnerabilities found.

Securing the host is not enough and you can't rely on Apple to help the user BE secure. A secure host pushes attackers to attack the next weakest spots such as communication and the user where Apple can only nudge the user into being secure. There are other issues for online commerce:

  • Weak passwords or lacking account protections against reset and intercept.
  • Security awareness for things such as fake SSL certificates or phishing websites.
  • Vulnerabilities in commercial websites that require user interaction, such as XSS, CSRF and Clickjacking.
share|improve this answer

One of the aspects not touched on yet in other answers is that mobile security is still relatively young, and by comparison with mature operating systems it is more difficult to gain assurance over the security functionality implemented.

So currently it is simpler to be more secure on a desktop OS- the tools are well known, the attack types are well known, and implementing layers of security is much more straightforward to the end user.

I still wouldn't use an ios or Android app for online banking, but do use a VM on my desktop machine as I can control it and wipe it after use.

share|improve this answer
1  
If you use the host for regular browsing, there is a risk of contracting malware that could monitor the VM. A safer approach is to use a VM for each kind of browsing, and don't use the host OS at all. –  Nic Feb 2 '13 at 16:25
    
Nic- that's exactly what I said... –  Rory Alsop Feb 2 '13 at 21:38

No

  1. iOS itself is not necessarily more secure than jailbreaked version. However, consider that for jailbreak to be possible iOS must have at least one security exploit by nature.
  2. Once installed, many security exploits are often corrected by jailbreak developers. However, you may be unable to review and/or understand the jailbreak itself, or any patches that promise to fix exploits. Therefore, it may not be possible to trust the jailbreak at all.
  3. When typing your password on screen, each key is "magnified" or enlarged on touch by the native iOS keyboard. Someone, or something (like a security camera), may be watching over your shoulder to steal your password.
  4. Proper security is not only just securing the client, but the entire communication chain and all devices associated with it. For example, if you are not communicating over HTTPS, the information could be stolen in transit. If your password is not store securely (such as a bad developer who saves passwords in plaintext), your password could also be leaked if a database is ever compromised.

About password selection itself: There are a number of discussions online, and available here at security.stackexchange.com. I've found (and I love) this: XKCD #936: Short complex password, or long dictionary passphrase?

share|improve this answer
3  
A Jailbroken IOS allows for unsigned code to be run. It essentially gives the user the ability to negate the restrictions imposed by apple. Additionally, to jailbreak IOS you often need to be tethered to the PC and actively manipulating the device. It would be difficult to jailbreak a device without noticing it happens as it would reboot your phone several times in the process. I'm not aware of Jailbreaking fixing security issues with IOS that apple has not patched. I'd like a link for that source. The only virus that's been released for IOS was due to default root pwd in jailbroken phones. –  NULLZ Feb 2 '13 at 10:57
    
@D3C4FF I think you're not well informed. There is some stranges storys (urban legends?) about forensic viruses able to delegate your phone to police (and strong hackers)...There is some parts: en.wikipedia.org/wiki/History_of_iOS_jailbreaking –  F. Hauri Feb 2 '13 at 11:05
    
@D3C4FF and there en.wikipedia.org/wiki/IOS_jailbreaking , news.yahoo.com/… –  F. Hauri Feb 2 '13 at 11:11
1  
"The first iPhone worm, iKee, appeared in early November 2009, created by 21-year-old Australian student Ashley Towns of Wollongong. He told Australian media that he created the worm to raise awareness of security issues: jailbreaking allows users to install a SSH service, which those users can leave in the default unsecure state." Source: The wiki link above... The second point you make "Once installed, many security failures will be corrected" is wrong based on that alone. And yes, i'm familiar with private 0-days for IOS used by Law enforcement. Jailbreaking does NOT secure your IOS Device! –  NULLZ Feb 7 '13 at 2:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.