13

Based on this question.

Why are there more research papers on Android malware than iOS malware?

5 Answers 5

48

Android has 87% market share. Even if attackers manage to infect small percent, that is still lot of devices they can cover in small time frame they get before the vulnerability is fixed or malware is detected.

Android suffers from infamous fragmentation problem due to which most android devices lose security updates after 3 - 4 years and forever become vulnerable to new vulnerabilities. This gives attackers large timeframe to spread malwares through various channels until they are caught by Google Play Store and anti-malware agencies. So more malwares are built for android devices.

Android allows flashing of custom images which can used to gain root access. This is useful for researchers to disable some SELinux policies, customise kernel, attach debugger with the malware, dump its memory and analyse post exploitation behaviour of malware in real environment.

Qualcomm, Samsung and MediaTek release platform tools for their SoCs which can reflash even hard-bricked devices. This lowers research cost and if experiments go wrong, there's a safe state to go back to without requiring specialised hardware programmers. Using these tools, the process can also be automated to test malware samples in different OS versions and in generic system images.

2
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – schroeder
    May 14, 2021 at 21:32
  • The fact that Android has 87% of market share is a good reason for criminals to use it, not for researchers to make research on this OS. Researchers are interested by poor quality OSes to warn everyone of the risk there is in using such a poor quality OS.
    – dan
    May 15, 2021 at 21:21
24

I can think of a few reasons:

  1. Android is open source

    That makes easier to analyze its workings and identify vulnerable code.

  2. It's more used

    More people use Android than iOS, so the resulting malware would infect more people.

  3. Emulators are more accessible

    Android emulators are more accessible. That makes testing different Android versions way easier.

  4. Sideload is very easy

    As Robert properly commented, it's easy to send someone a random APK and they will probably install.

  5. Custom ROMs

    There are hundreds of custom ROMs available, and some of them disable security features. They are mostly intended for development use, but some people use it as default ROM.

4
  • 7
    Don't forget that side loading apps is possible on Android but not on iOS. This makes it get malware onto devices if you want to avoid Play Store. Just place an APK on a web server, add a good story and people will download and install the app.
    – Robert
    May 12, 2021 at 19:55
  • 1
    Sideloading is definitely easier on Android, but it's not impossible to do on iOS. Apps can be signed with enterprise certificates or ad-hoc, which has been used by malware before. The user first needs to install the relevant certificate, and can then install the app. When Apple finds out, they can easily revoke the certificate though.
    – Dauntless
    May 14, 2021 at 16:00
  • Point 2 is only valid for virus like malwares. This is a small part of the malware population.
    – dan
    May 15, 2021 at 21:38
  • @dan it's valid for everything else too. You cannot run on Android, for example, an adware made for iOS. So making an effort to infect the platform with more users is more profitable, that's why there's almost no viruses for BeOS or QNX.
    – ThoriumBR
    May 15, 2021 at 23:08
7

It's easier and more profitable to write malware for Android, thus there is more research on, and more research papers about Android malware compared to iOS.

To break down why malware is more common for Android:

Easier

Android allows developers more freedoms(that can also be utilized maliciously), a few things worth mentioning:

  • Android can be 'rooted' by design, aka the default image is easily replaced with whatever the developer (hacker/script kiddie/whatever) wants
  • Android allows for side loading apps, something as simple as clicking on a "bad" link can lead to malicious downloads taking place in the background with the consumer only seeing a blank screen - or whatever else the nefarious actors chose.
  • Emulators for Android don't require any specific hardware, where iOS basically requires an apple computer, or a 1k+ investment (I say basically because, yes there are ways around it)

Android also has a problem with security updates. There are X numbers of vendors running Y versions of android at any time, most often with their own customizations to the OS, and manufacturer support ranging anywhere from 1-4 years on average. I've previously purchased Android tablets that don't let you update the OS at all, ever. Compare this to Apple longer support and consistent updates across a simplified line up of devices. It's easy to forget how integral software + hardware is in a security discussion - it's not just about the software and it's patches.

More profitable

Android holds a commanding lead in market share, even with the average income of iPhone owners markedly higher, the sheer number of Android users means a successful exploit can reach millions more people, and thus, turn millions more in profit.

Other Notes

I've often seen that Android being open source is a reason it's less secure - I personally reject that theory. In general, large, well supported open source projects are just as or more secure than their closed source counterparts. Further, companies like Apple and Microsoft expect that their source code is revealed in it's entirety from the start of their security planning. They know it's nearly impossible to hide indefinitely, and it's better to not rely on "hidden source code" to be secure.

One last tidbit I'd like to add, there may be more malware for Android, but that doesn't mean iPhone is inherently safer. It's simply what the (black) market dictates.

As well as the malware being more common, the open source nature of the project allow more security researchers to review and analyze the code, which also increases the amount of research papers about Android compared to iOS. Thanks @Nosajimiki for making this point clear/widening the perspective for this answer

11
  • 2
    "... something as simple as clicking on a "bad" link can lead to malicious downloads taking place in the background ..." - and then you have a dead malicious APK on the device that you could only install/activate if you went to the advanced app settings and allowed your browser to actually install it. How much malware is actually spread via APK sideloading I wonder.
    – Martin
    May 13, 2021 at 10:05
  • 3
    Android being FOSS as an argument for it having more security research is more realistically about it being easier to isolate and experiment with bugs if you can see the source code than it being somehow inherently more secure. May 13, 2021 at 11:28
  • 2
    How does the first point ("Android can be 'rooted' by design") relate to malicious usage? Do you mean that malware would root and reflash the phone, installing a compromised image? I've never heard of that happening, getting the bootloader unlocked is typically quite a complicated process that requires significant user intervention. Or do you mean that there's more malware exploiting already rooted phones just because there are more rooted Android phones?
    – TooTea
    May 13, 2021 at 12:15
  • 1
    @TooTea running a rooted Android has its advantages and a lot of advanced (or pretending to be advanced) users run rooted Android on a daily basis. A rooted device is easier to break in and way easier to hide in.
    – fraxinus
    May 13, 2021 at 13:27
  • 2
    Open source source projects inherently get more people analyzing, documenting, and publishing their vulnerabilities than closed source. While you are correct that open source does not necessarily make it less secure, it does answer the OP's question about why there is more research papers written about Android Security.
    – Nosajimiki
    May 14, 2021 at 15:26
2

The other answers focus on the fact that Android is fragmented, more accessible and has a larger market share. While this is all very true, there are a few other things that make it much more interesting for malware:

  • Android provides a lot more functionality that applications can abuse than iOS. Even without having to exploit vulnerabilities, malware can trick the user into giving it certain permissions which are very dangerous. Some examples:
    • Applications can request the SYSTEM_ALERT_WINDOW permission which allows them to draw on top of other applications. This is typically used with banking trojans that provide fake overlay windows to users.
    • Applications can register as an Accessibility Service. This allows them to read content from the screen, as well as input touches on the device to execute actions on the user's behalf. As soon as this accessibility permission is granted, the malware will typically disable Google Play Protect, give itself all other necessary permissions, hide itself from the launcher and make it more difficult for the user to uninstall it. The Accessibility Service can also be used to create a KeyLogger.
    • Applications can register to be the default SMS handler for incoming text messages, which allows them to easily intercept mTAN/2FA tokens, or confirm mobile subscriptions.
  • All devices below Android 10 are vulnerable to StrandHogg 2 which is a vulnerability in how Android tasks are managed. Applications cannot protect themselves against this, and it will be many years before most users have Android 10 or newer.
  • Some Android vendors will provide security patches, but not OS upgrades. This means that while they may be protected against specific vulnerabilities, the devices won't be able to protect themselves against API-related issues (such as the StrandHogg 2 vulnerability listed above).
  • Android applications can load code at runtime. This means that an application can put all the malicious code on a remote server and only load that code when specific criteria are met. This is one way in which Android malware often makes it into the Google Play store, since the malicious behavior will not be shown during the (automated) security verification of the Play store. Google does try to prevent dynamic code loading, since it's against the Play store EULA, but malware will try to hide this as much as possible.

The fact that Android is fragmented is definitely true, but most malware doesn't even try to obtain root privileges. Because it is so fragmented, it actually takes more effort to create an exploit that would reliably work on multiple Android devices than on iOS. This is one of the reasons why a zero-click exploit for Android is now worth more than iOS.

If you want to attack iOS, you will have to exploit either known or unknown vulnerabilities which requires a significant investment. This does happen, but it's usually as a targeted attack rather than just for making some money. Add to this that iOS updates are delivered to end-users in a very short time period and the number of supported iPhones for new iOS versions is also impressive. This makes using known vulnerabilities much less interesting.

-3

It is the simple consequence of the law of supply and demand:

  1. Android (and all OEM-provided versions) is a much more vulnerable OS than iOS.

  2. Then there is a much larger market of weapons targeting Android than iOS. The ratio of malware (of any kind), last time I checked (10 years ago), was 10⁴:1 in one full year. This ratio is not proportional to market share nor to the impact size a virus could have.

  3. This huge advantage in the attack surface of Android implies that there is much more work to make to improve Android security than iOS security and that there are many more products to sell on the security market.

  4. Then the research on securing Android is a profitable and wide field (is this field infinite is still an open question from my point of view). I would say a kind of bottomless well.

7
  • 2
    This is in no way "security theater". I think you mean a different term. If the problem actually exists, then it's not "theater".
    – schroeder
    May 13, 2021 at 14:41
  • 1
    Android has ART which is a sandbox. You cannot run android in privileged mode in normal use. Android and iOS have almost equivalent level of security.
    – defalt
    May 13, 2021 at 21:11
  • 4
    In order to run "Android in privilege mode" (namely, root apps) you have to undergo a procedure that can never be done unintentionally, because Android is designed to do so. Most recent iOS-es can't simply be rooted. May 14, 2021 at 11:40
  • @Schroeder the fact that there are many security dealers who are happy to sell a product on an OS of poor quality is a shame. These dealers would be much more honnest by advising officially everyone to stop using crap software. This lie in the security market is what usually professionnals in the security field name the "security theater".
    – dan
    May 15, 2021 at 21:34
  • @dan ... right ... because we should only be using perfectly secure products at all times and anyone who dares help to improve the security of a popular product is a dishonest and evil profiteer. Got it. And what is the colour of the sky in your world? Or, a better question, what device, OS, and software are you using?
    – schroeder
    May 16, 2021 at 7:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.