I was searching for reports about malware on the Apple App Store and only found minor ones (at least from a user's perspective) on the first few Google search results.

Doing the same search for the Android Play Store leads to several severe kinds of malware.

Where does the difference come from?

The typical answer you find online is that "Apple does stricter reviews", but I think that isn't a good answer to my question.

I did upload apps to both stores already. The reviews are stricter, but I think the focus here is more on usability / if the app holds what it promises. Less on security. Somebody just clicks through the app and compares if the screenshots look like the app. It shouldn't be hard to create malware that passes this kind of check.

Is there anything fundamentally different? e.g. does maybe the permission system of iPhones allow less than the one of Android? Or are the app bundles different in a way that makes automatic security analysis easier?

Or is that whole topic maybe rather a purely subjective impression and both software marketplaces suffer exactly the same kind/magnitude of malware?

  • As long as there are no any proofs, no links to any statistics or researches, it is not correct to make your opinion to look as a fact. That's why I removed the statement from the title.
    – mentallurg
    Commented Mar 5 at 7:42
  • How do you know that the code reviews do not include security? Your claim that the only check is a UI comparison is not correct at all.
    – schroeder
    Commented Mar 5 at 9:12
  • It's nothing I'm certain about. I guess that they have automatic security checks (just like the play store), but I am also very certain that not every single uploaded app version has a security researcher taking the app apart. That would just be economically not feasable. Commented Mar 5 at 10:55

1 Answer 1

  1. There are checks beyond the ones you talk about. Apple restricts what APIs apps are allowed to call, and what functional behaviors apps are allowed to have. Now, there's ways around all of that, but it raises the bar somewhat.
  2. You're correct that the permissions model on Android is more expansive; in most cases apps will have similar permissions (and in some cases, Android allows better controls over app permissions than iOS does), but it's possible to give Android apps privileges that there's no (publicly available) equivalent of for iOS. (However, note that quite a lot of malware doesn't actually need particularly high privileges; one of the most common is "ability to send SMS".)
  3. Apple requires more commitment from developers. With requirements such as paying for the privilege of submitting apps, malware becomes less attractive; it both needs to actually succeed at making you money (or whatever your goal is) sufficient to offset the cost, it also creates a stronger paper trail tying you to the app you published. Intentionally distributing malware to unknowing victims is a crime, and - unless the stakes are quite high - smart criminals generally avoid doing things where it'll be too easy to trace back to them after the fact.
  4. This is becoming less true, but: market share. Even in developed countries, iOS has a long way to go to overcome Android's market share; in poorer regions, iOS devices are status symbols but Android is what ~everybody has. If you're writing malware that you hope will earn you an average of a dollar per install, it just doesn't make a lot of sense to devote your resources to developing for the smaller market unless you have some reason to expect a greater proportion of them to install.
  5. Sheer number of apps. There are about twice as many apps on the Google Play Store as on the Apple App Store. While the ratio of malicious apps is probably still much higher on Android, this does likely play some role in the different numbers on each platform.

There may be other reasons; there are a lot of kinds of malware in the world, even specifically mobile malware, and I'm not sure where the differences between Apple and Google are in each case. It's also possible that reputation plays a part; everybody "knows" that Apple is more secure, so nobody targets it. On the other hand, the general reputation for trustworthiness that Apple has engendered for App Store apps makes them a great target, as does the fact that Apple users are generally more willing to pay for things and in some regions are (statistically speaking) more affluent. I expect sophisticated malware to target iOS more, for this reason (and because sophisticated attackers are more able to work around the numbered items above). However, most malware - like most crime, and indeed most anything - is not particularly sophisticated; people go for the easy path, and right now that's Android even if the payoff is potentially higher on iOS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .