12

PCs communicate with the help of ports,eg. HTTP communication takes place over port 80. Due to the nature of these ports, an open port is an avenue for an attack. That's where firewalls come in.

The smartphones also communicate with the Internet. But, AFAIK, they don't come configured in any way with a firewall of any kind. Doesn't that mean that my phone is practically open for access by anyone?

|improve this question
  • 2
    Firewalls protect services on those ports. Phone don't provide services on ports, they make outgoing connections. – schroeder♦ Aug 24 '15 at 14:39
  • Aren't incoming connections possible on those ports? – Mayank Singh Aug 24 '15 at 14:43
  • What would those incoming connections connect to? – schroeder♦ Aug 24 '15 at 14:48
  • 2
    Just because a port is open does not mean it is vulnerable. – Bacon Brad Aug 24 '15 at 17:48
  • 1
    It might be worth linking my question about open, inactive ports here for reference. – Corey Ogburn Aug 24 '15 at 22:14
16

If nothing is listening on a port, no connection can be made to it, firewall or not. The same applies for desktop computers and servers. In theory, you're still safe without a firewall if nothing is listening and the TCP stack in the OS isn't vulnerable.

We have the habit to use firewalls on desktops/servers because they are available and every layer of security helps, but mobile OS developers thought that was unnecessary and are confident in their TCP stack implementation (I suppose a firewall would induce additional CPU load which will decrease battery life).

There is actually a long debate on Serverfault about whether you should use firewalls on servers, you should check it out and make your own choice whether you want to install a firewall on your mobile device.

Also note that most mobile networks out there use carrier-grade NAT which means, at least on IPv4, that your device isn't directly reachable from the Internet and this provides some sort of basic protection (you're still exposes to attacks coming from that same mobile network). Of course this point no longer applies with IPv6.

|improve this answer
  • 1
    Doesn't Wifi connectivity affect your last paragraph? The phone could be reached any other connected device, couldn't it? – WhiteWinterWolf Aug 24 '15 at 15:23
  • 2
    From the Internet point of view, yes indeed, however Wifi networks (especially public ones) may be less trustable than carrier network. – WhiteWinterWolf Aug 24 '15 at 19:50
  • 1
    @AndréB.: you are discussing firewalls only from the point of view of incoming conections. But there are outgoing connections by rogue applications, too. – Martin Argerami Aug 24 '15 at 22:35
  • Mobile carriers also provide IPv6, which gives your phone a globally routable address. Don't count on NAT for security. – josh3736 Aug 24 '15 at 23:34
  • Firewalls isn't there to protect against the TCP stack. It's there to protect against malicious services (worms/viruses). For iOS, Apples' approach to bad programs seem to be working fairly well. Reject programs that act like viruses or if they've been accidentally released uninstall them from users' phones. It seems to be working for Android too lately. Though in the early years there were lots of malicious programs on Android. – slebetman Aug 25 '15 at 5:45
2

Doesn't that mean that my phone is practically open for access by anyone?

You are vulnerable to Wi-Fi eavesdropping but also to malicious applications you may run on your smartphone. By default smartphones do not come with Firewall, but in case you run lot of applications of which you are not very sure how much safe they are (say your kid is playing all sorts of games on his Android), then a malicious application could leak private data from your smartphone. That is why there is, for instance, for Android a firewall called DroidWall which:

allows you to restrict which applications are permitted to access your data networks (2G/3G and/or Wi-Fi).

But this won't protect you from Wi-Fi eavesdropping in a shop, restaurant ...

Smartphone firewall's will rather restrict access of the applications that run on them to the Internet as @shroeder said.

|improve this answer
  • For blocking malicious apps, why not DroidWall/AFWall? (Ironically I don't think there's a one for iOS because they think it's more secure to not let any app have access to root/iptables for firewall.) – NoBugs Jul 3 '16 at 3:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.