Why are there more research papers on Android malware than iOS malware?

Question

Based on this question.

Why are there more research papers on Android malware than iOS malware?

Answer 1

Android has 87% market share. Even if attackers manage to infect small percent, that is still lot of devices they can cover in small time frame they get before the vulnerability is fixed or malware is detected.

Android suffers from infamous fragmentation problem due to which most android devices lose security updates after 3 - 4 years and forever become vulnerable to new vulnerabilities. This gives attackers large timeframe to spread malwares through various channels until they are caught by Google Play Store and anti-malware agencies. So more malwares are built for android devices.

Android allows flashing of custom images which can used to gain root access. This is useful for researchers to disable some SELinux policies, customise kernel, attach debugger with the malware, dump its memory and analyse post exploitation behaviour of malware in real environment.

Qualcomm, Samsung and MediaTek release platform tools for their SoCs which can reflash even hard-bricked devices. This lowers research cost and if experiments go wrong, there's a safe state to go back to without requiring specialised hardware programmers. Using these tools, the process can also be automated to test malware samples in different OS versions and in generic system images.

Answer 2

I can think of a few reasons:

1. Android is open source

   That makes easier to analyze its workings and identify vulnerable code.

2. It's more used

   More people use Android than iOS, so the resulting malware would infect more people.

3. Emulators are more accessible

   Android emulators are more accessible. That makes testing different Android versions way easier.

4. Sideload is very easy

   As Robert properly commented, it's easy to send someone a random APK and they will probably install.

5. Custom ROMs

   There are hundreds of custom ROMs available, and some of them disable security features. They are mostly intended for development use, but some people use it as default ROM.

Answer 3

It's easier and more profitable to write malware for Android, thus there is more research on, and more research papers about Android malware compared to iOS.

To break down why malware is more common for Android:

Easier

Android allows developers more freedoms(that can also be utilized maliciously), a few things worth mentioning:

• Android can be 'rooted' by design, aka the default image is easily replaced with whatever the developer (hacker/script kiddie/whatever) wants
• Android allows for side loading apps, something as simple as clicking on a "bad" link can lead to malicious downloads taking place in the background with the consumer only seeing a blank screen - or whatever else the nefarious actors chose.
• Emulators for Android don't require any specific hardware, where iOS basically requires an apple computer, or a 1k+ investment (I say basically because, yes there are ways around it)

Android also has a problem with security updates. There are X numbers of vendors running Y versions of android at any time, most often with their own customizations to the OS, and manufacturer support ranging anywhere from 1-4 years on average. I've previously purchased Android tablets that don't let you update the OS at all, ever. Compare this to Apple longer support and consistent updates across a simplified line up of devices. It's easy to forget how integral software + hardware is in a security discussion - it's not just about the software and it's patches.

More profitable

Android holds a commanding lead in market share, even with the average income of iPhone owners markedly higher, the sheer number of Android users means a successful exploit can reach millions more people, and thus, turn millions more in profit.

Other Notes

I've often seen that Android being open source is a reason it's less secure - I personally reject that theory. In general, large, well supported open source projects are just as or more secure than their closed source counterparts. Further, companies like Apple and Microsoft expect that their source code is revealed in it's entirety from the start of their security planning. They know it's nearly impossible to hide indefinitely, and it's better to not rely on "hidden source code" to be secure.

One last tidbit I'd like to add, there may be more malware for Android, but that doesn't mean iPhone is inherently safer. It's simply what the (black) market dictates.

As well as the malware being more common, the open source nature of the project allow more security researchers to review and analyze the code, which also increases the amount of research papers about Android compared to iOS. Thanks @Nosajimiki for making this point clear/widening the perspective for this answer

Answer 4

The other answers focus on the fact that Android is fragmented, more accessible and has a larger market share. While this is all very true, there are a few other things that make it much more interesting for malware:

• Android provides a lot more functionality that applications can abuse than iOS. Even without having to exploit vulnerabilities, malware can trick the user into giving it certain permissions which are very dangerous. Some examples:
  • Applications can request the SYSTEM_ALERT_WINDOW permission which allows them to draw on top of other applications. This is typically used with banking trojans that provide fake overlay windows to users.
  • Applications can register as an Accessibility Service. This allows them to read content from the screen, as well as input touches on the device to execute actions on the user's behalf. As soon as this accessibility permission is granted, the malware will typically disable Google Play Protect, give itself all other necessary permissions, hide itself from the launcher and make it more difficult for the user to uninstall it. The Accessibility Service can also be used to create a KeyLogger.
  • Applications can register to be the default SMS handler for incoming text messages, which allows them to easily intercept mTAN/2FA tokens, or confirm mobile subscriptions.
• All devices below Android 10 are vulnerable to StrandHogg 2 which is a vulnerability in how Android tasks are managed. Applications cannot protect themselves against this, and it will be many years before most users have Android 10 or newer.
• Some Android vendors will provide security patches, but not OS upgrades. This means that while they may be protected against specific vulnerabilities, the devices won't be able to protect themselves against API-related issues (such as the StrandHogg 2 vulnerability listed above).
• Android applications can load code at runtime. This means that an application can put all the malicious code on a remote server and only load that code when specific criteria are met. This is one way in which Android malware often makes it into the Google Play store, since the malicious behavior will not be shown during the (automated) security verification of the Play store. Google does try to prevent dynamic code loading, since it's against the Play store EULA, but malware will try to hide this as much as possible.

The fact that Android is fragmented is definitely true, but most malware doesn't even try to obtain root privileges. Because it is so fragmented, it actually takes more effort to create an exploit that would reliably work on multiple Android devices than on iOS. This is one of the reasons why a zero-click exploit for Android is now worth more than iOS.

If you want to attack iOS, you will have to exploit either known or unknown vulnerabilities which requires a significant investment. This does happen, but it's usually as a targeted attack rather than just for making some money. Add to this that iOS updates are delivered to end-users in a very short time period and the number of supported iPhones for new iOS versions is also impressive. This makes using known vulnerabilities much less interesting.

Answer 5

It is the simple consequence of the law of supply and demand:

1. Android (and all OEM-provided versions) is a much more vulnerable OS than iOS.

2. Then there is a much larger market of weapons targeting Android than iOS. The ratio of malware (of any kind), last time I checked (10 years ago), was 10⁴:1 in one full year. This ratio is not proportional to market share nor to the impact size a virus could have.

3. This huge advantage in the attack surface of Android implies that there is much more work to make to improve Android security than iOS security and that there are many more products to sell on the security market.

4. Then the research on securing Android is a profitable and wide field (is this field infinite is still an open question from my point of view). I would say a kind of bottomless well.