Is Android secure?

There’s been a lot of talk lately in swedish media about the security of smart phones. This news report (in swedish) by the swedish public service TV station SVT shows how easy it is to hack into your iPhone and do all kinds of weird stuff, such as recording audio using the phone’s microphone or sending an SMS.

Following that report the well known swedish Android site Swedroid published an interview (also in swedish) about the security of Android. This post is written in response to that interview.

Android security

In Android, every application is installed in a sandbox, and every application runs as an isolated user. What this means is that, in the normal case, no application can access other applications’ data. Access to files and directories is restricted using the normal Unix security model. Files and directories in the filesystem belong to a user and a group. Every file or directory also has a set of permissions which restrict access to it for the owner of the file, members of the same group as the file, or “everyone”. For a detailed explanation see this.

Even if this security model has been used for a very long time, it doesn’t mean that it’s secure. It all depends on what you mean by “secure”. After all, you don’t need root access on a phone to be able to do all kinds of nasty stuff. I’ll try to just give a few examples of how your phone can be hacked. Keep in mind that these are just the obvious ways of hacking which I could come up with in the time it took to write this. Imagine a hacker with far greater imagination…

Example 1: Installing a bad application

The easiest way to get your phone hacked is simply by granting an application permission to access your personal data. This happens all the time, and distributing a malicious application is as easy as publishing it on a webpage, or even easier on Android Market.

For example, say you install an application which requests permission to access the network, and at the same time access your phone book. This application could easily just read your entire phone book and send all the details to a server somewhere on the Internet.

This method might seem like a nobrainer to stop, but truth be told most of the good applications on Android Market require network access. If you choose to not install them you’re left with a pretty useless device.

Example 2: Installing a pair of bad applications

Ok, so you decided to stop installing applications which require both network access and which could access sensitive data at the same time. That’s one step in the right direction, but don’t think this makes you safe!

The problem is that even though a single app cannot do both of the things, if you install one app which for example can read your SD card, and then install a second app which can access the network, you could be just as vulnerable. The first app can read all the files on your SD card, send them to the second app, which in turn sends it to a server on the Internet, and you’re just as screwed as in the previous example.

Example 3: Exploitable vulnerability in phone software

This thing is what most people mean when they use the term “hacking”. Unsolicited attempts to do more than the user has allowed you to do with their phone.

The most obvious example is to exploit vulnerabilities in core system functions which gives you root access to the device. Since there are probably many vulnerabilities in the code running in an Android phone, this might sound pretty easy at first glance. However, to get root access, you need to hack an application which already runs as root, and there are only a few of those running in a phone.

As I said before, root access is not at all necessary to do evil deeds. Let’s say the hackers manage to find a security hole in the e-mail application. If they can exploit this, they can do anything that the e-mail application can do, and that probably means access all your e-mails and sending them to a server somewhere on the Internet.

Example 4: Sniffing network traffic for passwords

While this example is not directly related to phones, it is still a very common method of “hacking”. The general idea is that most passwords are sent in clear text to servers. If the hacker can place himself somewhere in between you and the server, he can easily see all of your passwords, and later use them to log in to for example your e-mail account. These so called “man-in-the-middle” attacks are fairly easy to do, especially on WiFi networks.

The easiest way of protecting yourself against this is to always use encrypted protocols for communicating with servers on the Internet. For example, you should use TLS encryption for all of your e-mail sessions, and preferrably even encrypting outgoing messages using PGP or S/MIME or similar. The latter is usually not supported in e-mail applications on phones, though.

So, is Android secure?

There’s really no simple “yes” or “no” answer to this question. The truth is that the security of Linux is pretty well tested, but Google has made many changes to Linux during the development of Android. Add to this the fact that every platform vendor and phone manufacturer makes even more changes to the system, which leads to a situation where lots of critical code in our phones is not as well tested as the Linux kernel.

As you could read in the above text, hackers don’t need security holes in the software to do their magic, however. Malicious code can end up in your device anyway. For a normal user, there really is no reason to panic, but it would be stupid to ignore the security issues altogether. After all, malicious code could be used to make expensive phone calls and/or sending lots of text messages, which could lead to serious monetary damage.

If you’re paranoid, then simply don’t install anything which asks for any strange permissions at all. Especially, don’t install applications which need network access. Even then, you’re forced to trust Google, the phone manufacturer, the platform vendor, and just about any 3rd party software author that develops applications which are shipped with your phone to begin with. Although I find it highly unlikely that these would deliberately plant malicious code in your device, there could be many security vulnerabilities in their code!

Most people have a firewall and an antivirus program installed on their computer; the same is certainly not true for phones, for obvious reasons. Even with such applications installed, you wouldn’t be safe. Secondly, people have a tendency to ignore security warnings. Even if a large dialog box popped up saying “Installing this application will kill you!” people would still install it.

In the end, a smart phone is just as secure as any normal computer, which means it’s very insecure if used incorrectly. The only way of protecting yourself against hacking is to learn more about computer security and use common sense, so be smart!

Leave a Comment

NOTE - You can use these HTML tags and attributes:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>