Gphone vs. iPhone: The security debate begins

It wasn't long after Google announced its long-anticipated mobile plans this week that a debate emerged about the prospective security of the project's Linux-based platform.
Can the open-source model for the platform, now known as Android, produce secure code? Will phones based on Android, dubbed "Gphones" by many, be more or less secure than Apple's iPhone, which has been developed using proprietary software? What will Android's developers be able to do to stop authors of malicious code from capitalizing on its openness?
Security vendor McAfee, which produces proprietary security software for mobile devices, has been quick to defend open-source practices for developing mobile code.
McAfee is a member of the Linux Mobile (LiMo) Foundation, a group of companies formed to develop an open mobile-device software platform. Many of the companies in the LiMo Foundation have also become members of the Open Handset Alliance (OHA), which Google has formed to develop and promote Android.
Jan Volzke, global marketing manager for McAfee Mobile Security, said that Linux is not new to the mobile arena and maintained that secure coding practices can successfully be built into the Android development process.
"Japan has a large deployment, with 60 percent of phones powered by Linux. McAfee protection has been integrated in the majority of these mobile Linux phones for many years," Volzke said. "For any mobile-device platform, security should not be a developer option but a mandatory requirement. Consumers--as well as operators--expect devices to be safe from the outset, with no effort required from them."
Volzke said security can be built in from the beginning of the development process by collaboration between security companies, although at the moment McAfee is the only security player in the LiMo Foundation.
Open coding practices nonetheless seem ripe for abuse. Making source code available to everyone inevitably invites the attention of black-hat hackers.
"Linux has so far been used on the enterprise-server side, with most deployments being professionally IT administrated," Volzke said. "Due to a number of industry initiatives, especially the LiMo Foundation--and now also the Open Handset Alliance--Linux will become more widely available in the consumer space. As a result, visibility to already experienced hackers increases. Open means open to everyone--with (both) good and malicious intent."

Where bugs most likely breed

The debate about the relative security merits of open source as opposed to proprietary software development has been long-running. Open-source software development has the advantage of many pairs of eyes scrutinizing the code, meaning irregularities can be spotted and ironed out, while updates to plug vulnerabilities can be written and pushed out very quickly. However, one disadvantage of open-source development is that anyone can scrutinize the source code to find vulnerabilities and write exploits.
The source code in proprietary software, on the other hand, can't be directly viewed, meaning vulnerabilities need to be found through reverse engineering. However, as fewer people see proprietary source code, critics argue that code is more likely to be buggy. Some observers also claim that once vulnerabilities have been found, updates are slower to be pushed out, especially by large multinational software companies.
Most security vendors try to avoid commenting on whether open-source or proprietary software is more secure, often arguing that it is like comparing apples to oranges.
Volzke said it wasn't possible to compare the security of development practices for Android-based devices andApple's iPhone handset, which will be released in the U.K. on Friday. "Apple's iPhone has nothing to do with open source. Instead Apple will provide a software development kit," Volzke said. "Comparing the security challenges for an open-source device platform versus a device-specific software development kit will result in different conclusions."
One security vendor was willing to make a prediction, albeit gingerly. Ben Whitaker, head of security at mobile-security development company Masabi, came down cautiously on the side of open source. "Gphone is open source, which means it can get a good kicking and shoeing, and can be worked on by just about anyone," Whitaker said. "It's starting out in a better way than the iPhone, which has seen vulnerabilities. However, any new consumer (of both the iPhone and Gphone) won't be secure when the first product comes out."
Whitaker said that given the iPhone's record of vulnerabilities and its full, smartphone Internet connectivity, it would be more vulnerable than a strictly Java-based mobile platform, which he classified as "semi-smart." It will not be known until the Android software development kit comes out on Monday whether the Gphone will be strictly Java-based.
In the case of the iPhone, "with any brand new Web browser, malicious Web sites will take advantage of Ajax, JavaScript, and ActiveX vulnerabilities," Whitaker said. "The less smart a phone is, the less vulnerable it is. (Android) developers should stick to a semi-smartphone platform because the Java sandbox can protect against the normal kinds of attacks."
Whitaker added that, like the iPhone, Gphone devices will have vulnerabilities. "The Gphone could allow full apps to run on it, which would open it to keyloggers," Whitaker said. "At the moment, the Gphone platform doesn't run on an encrypted file system and has a vulnerable log-in. It's so stealable that (an encrypted file system and a secure log-in) should by default be included."
With much development work yet to take place--and the U.K. market still waiting for both the Apple and Google-based devices to arrive--the jury remains out for the definitive ruling on which model will be most secure. But one thing is for certain: no device that connects to the outside world can be totally secure, and neither the iPhone nor Gphone will prove to be the exception.
Source: Tom Espiner of ZDNet UK reported from London. (News BroadCast)

With proprietary, neglecting version X, Y, or Z, the platform is the same--you can guarantee the vulnerability exists with a very small number of conditions (i.e. it's been patched because it's known or the feature is turned off).

With Open Source, the 5-10% of the community who will want to poke around their code, and will distribute the changes to the community, will result in 20-25% of the community having different sets of vulnerabilities, when and if a vulnerability is found (they are there, but then again, large portions of the code, is mature, while other portion are new, thus a large number of the potential vulnerabilities are ironed out).
But then again, iPhone runs everything as root, while Android is unlikely to do so, as security (including permissions and SELinux--which is a large security aid in and of itself) are there to prevent (most) exploitation. Apple could use similar features and tools, but they don't want to.
But Google has had to deal with security for years too, as they are a prime target for hackers and DDOS attacks.
So, time will tell. We will know in a few years to some degree.

Cheers !