Can malware run on mobile devices? I don't see how it would be able to (given that those devices have fine-grained permissions and sandboxing). Unlike on a desktop OS, malware cannot access registry components; it also can't have root access unless the device is rooted. So does this mean current mobile OSes are immune to standalone malware?

closed as too broad by schroeder, Eric G, M'vy, RoraΖ, Xander Mar 17 '15 at 13:53

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    What do you mean, "standalone malware?" – cpast Mar 17 '15 at 1:34
  • I guess this might be an independant malware, a worm as opposed to a virus which is inside the code of an host application. – dan Mar 17 '15 at 1:51
  • This question is easily answered with a single Google search term. Perhaps we don't understand what you're asking. – schroeder Mar 17 '15 at 2:27
  • @schroeder Let me clarify. I am not talking about the viruses embedded in application. I am talking about the worms, that bypass the usual "installation process" including asking permission. An example, in PC, worms dont need to be embedded in sofitwares. – Shasi Mar 17 '15 at 4:31
  • @danielAzuelos, yes. you are right. – Shasi Mar 17 '15 at 4:33

Yes. Just about every security feature of mobile operating systems is implemented in software. Complex software like that can will have bugs. Some of these bugs will be exploitable to give unauthorized access. This applies to any sufficiently complex software, because programmers are no more superhumanly perfect than anyone else.

  • Will your answer be different if you see my last comment ?? – Shasi Mar 17 '15 at 4:32
  • No. The code that handles networking is no more perfect than the code that handles anything else. There is zero difference from desktop PCs in this regard. – cpast Mar 17 '15 at 4:40
  • 1
    For some context: OpenBSD is somewhat famous for being security-obsessive. They continually audit their code for bugs of any sort (not waiting until an exploit is found). The default install has virtually nothing enabled to minimize the attack surface to things you really need. Unlike Apple or Google, security is prioritized over new features; they'd rather focus on fixing things then adding new stuff. And this locked-down highly-audited system has had two vulnerabilities over the years that allowed arbitrary code execution by a remote attacker. Nothing is perfectly secure. – cpast Mar 17 '15 at 5:05
  • 1
    To add another example. Android is really just the Linux Kernel with a complex GUI placed on top of it. A search for ipv4 in the Linux Kernel bug reports yields tons of bugs. Not all of them will be exploitable, but could be triggered via remote packet sequences. I've found vulnerabilities before in the IPv6 stack. – RoraΖ Mar 17 '15 at 11:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.