(T) The architecture and implementation of iOS and Android are both similar when you compare feature-to-feature, and different when you compare implementation-to-implementation. Very basically, the iOS security model is based on the following framework:

• iOS limits the attack exposure
• “One” sandbox model for ALL apps
• Limited permissions are given to apps to access system resources
• The App Store requires mandatory code signing. Code signing is enforced: no introduction of new executable code – already loaded executable code cannot be changed
• Data protection for apps is based on passcodes and hardware generated encryption key

Apple has a good white paper which describes the complete security model of iOS 9: https://www.apple.com/business/docs/iOS_Security_Guide.pdf

While the Android security model is based on the following framework:

• Linux process sandbox
• Permission-based component interaction
• Permission labels defined in AndroidManifest.xml
• Apps need to be signed. Signature defines persistence and authorship
• Security decisions are taken at app install time

Since Android KitKat 4.4 and the introduction of the SE Linux kernel into Android, Google has definitely improved over the years the security of the Android platform. In addition, Google, over the last few releases of Android, has improved the security of the apps on Google Play. It used to be that you can take an existing and popular Android app, inject malicious code – a trojan – and re-package and re-sign the app with a new key/certificate. But that is not the case anymore.

Google also has some good resources to better understand the complete security model of Android https://developer.android.com/guide/topics/security/permissions.html and published recently a new report about the state of Android security: https://source.android.com/security/reports/Google_Android_Security_2015_Report_Final.pdf

Note: The picture above is a picture of the iOS fingerprint scanner.

Copyright © 2005-2016 by Serge-Paul Carrasco. All rights reserved.
Contact Us: asvinsider at gmail dot com.