4 ms·

> You can't get viruses on iOS unless you're jailbroken - Apple's walled garden pretty much guarantees that. No. Apple can't guarantee their software is secure

> You can't get viruses on iOS unless you're jailbroken - Apple's walled garden pretty much guarantees that. No. Apple can't guarantee their software is secure, so their walled garden doesn't guarantee anything like what you say.

valine 9y ago
For all practical purposes its true. There has never been a major malware outbreak on iOS, and iOS has never been more secure than it is now. A while back Apple started pulling anti-virus apps from the app store presumably because they aren't needed: https://9to5mac.com/2015/03/19/apple-app-store-antivirus/ https://9to5mac.com/2015/03/19/apple-app-store-antivirus/. For contrast here is Microsoft's official article on protecting your PC from viruses: https://support.microsoft.com/en-us/help/17228/windows-protect-my-pc-from-viruses https://support.microsoft.com/en-us/help/17228/windows-prote... In addition, about 80% of iPhones in use are running the latest version of iOS. Apple can patch exploits and have the majority of iPhones secured in a short amount of time. iOS is unique in that respect, and that is just one mitigating factor that makes iOS malware very implausible.
- Chaebixi 9y ago
  That's just marketing hype mixed with a little bit of goalpost moving. "Has never been more secure than it is now" != secure. > A while back Apple started pulling anti-virus apps from the app store presumably because they aren't needed. I think you presume too much. An effective antivirus program cannot run in a sandbox that isolates it from other processes. If Apple pulled 3rd party antivirus apps, I bet it was because they could not both work as advertised and simultaneously obey the sandbox, not because they "aren't needed" (presumably because the platform is "secure"). As for your original statement: >> You can't get viruses on iOS unless you're jailbroken - Apple's walled garden pretty much guarantees that. Here's a counterexample: https://www.kaspersky.com/blog/pegasus-spyware/14604/ https://www.kaspersky.com/blog/pegasus-spyware/14604/
  - deleted 9y ago
    [deleted]
  - valine 9y ago
    Pegasus was used by governments to target specific individuals. If you're being targeted by governments I would agree you're out of luck even on iOS.
    - Chaebixi 9y ago
      So, in other words, iOS is insecure and vulnerable to malware. Governments don't have special hacking powers, they mainly have money and manpower. It's true, iOS might raise the bar a little bit compared to some other systems, but IMHO it's misleading and dangerous to claim that it's invulnerable.
      - valine 9y ago
        The point is you're not going to get malware if you open the wrong email or go to the wrong site like you could on Windows. The organizations with enough resources to hack iOS devices aren't interested in sending mass emails to steal bank account details. The average iOS user who keeps their device up to date simply doesn't have to worry about malware and suggesting otherwise is misleading.
        Chaebixi 9y ago
        > The organizations with enough resources to hack iOS devices aren't interested in sending mass emails to steal bank account details. The average iOS user who keeps their device up to date simply doesn't have to worry about malware and suggesting otherwise is misleading. Again, no. Here's another counterexample (which is recent and appears to have been active on the App Store for ~1yr): https://researchcenter.paloaltonetworks.com/2016/03/acedeceiver-first-ios-trojan-exploiting-apple-drm-design-flaws-to-infect-any-ios-device/ https://researchcenter.paloaltonetworks.com/2016/03/acedecei... "These malicious iOS apps provide a connection to a third party app store controlled by the author for user to download iOS apps or games. It encourages users to input their Apple IDs and passwords for more features, and provided these credentials will be uploaded to AceDeceiver’s C2 server after being encrypted." That's not state actor stuff. However, I shouldn't have to keep providing counterexamples to convince you of your absurd claims of practical invulnerability. Apple has not made any kind of security quantum leap: no one has. Apple's systems are vulnerable to the same types of flaws, by the same types of attackers, as any other system in wide use. The main difference is that Apple has restricted their platform to the extent they have an easier time implementing security best practices. iOS is still vulnerable to flaws Apple doesn't know about or hasn't patched, and those flaws can be exploited for as long as Apple remains unaware or fails to act. That's not fundamentally different position from Microsoft, Google, or any other similar company.
- StillBored 9y ago
  There is plenty of iOS malware, its just burred behind a "free" app which appears to be a simplistic game or whatever..
  - djrogers 9y ago
    Citation? AFAIK the iOS sandbox has not been broken on un-jailbroken iOS devices, so at worst you're getting a garbage app that doesn't do what it promises. I've never seen nor heard of any actual malware outbreak from a non-jailbroken app.
    - 1ris 9y ago
      I know next to nothing about iOS, so: Why can't the (usually public) jailbrake-exploit or another, similar potent (and probably quite expensive) be launched from inside the app? Sure, it has to be hidden to get into the store, but that looks very easy compared to finding the actually jail break. One just has to hide a arbitrary code execution vuln in the code of the app somewhere. So, every apps seems to be an attack sureface.
      - valine 9y ago
        If there was a jailbreak available, yes. But there hasn't been a publicly available untethered jailbreak since March of 2016, and there has never been an untethered jailbreak of iOS 10. The only jailbreak for iOS 10 was semi-teathered and only made public after Apple had patched the vulnerabilities. In order for this to work as malware the user would have to open the malicious app every time their phone restarts. Not only that, every time the they open the app their phone would appear to be out of storage and then promptly crash to the boot screen. It would be a bit of a hard sell.
    - StillBored 9y ago
      Maybe I should have put malware in quotes. I was generally referring more to the privacy invading, battery sucking, ad displaying, etc behaviors of the vast majority of applications. Which per wikipedia (and traditional usage of the term) makes them malware. Apple/etc seem to be suck in the mindset of the various antivirus products before the advent of adaware/etc. So the products aren't strictly virus/trojans/worms/etc but they definitely fit the definition of malware and the end results are potentially just as bad. I would actually prefer any number of virus's over the some of the shenanigans the facebook app has been accused of.
- deleted 9y ago
  [deleted]
oneplane 9y ago
While there is of course no guarantee, most of the shitstained-OS-installations that were (or still are?) so common, with symptoms like non-functional systems, ads popping up, or having 90 toolbars are due to user actions. Sure, there are methods to deliver and elevate malware, but most of the 'problems' people experienced (before widespread banking malware) were practically "cosmetic" and "slowness" and almost always due to users randomly downloading and executing anything in their path. With iOS, that pattern is a lot harder to abuse, and with enforced sandboxing, side-effects between programs (or, 'apps') are somewhat non-existent. Most of the things that make non-Windows systems less infected seem to either be due to a better security design, less casual users or a drastically lower market share making it a smaller target with possible less effective organic spreading of malware. (or possibly a combination of the three)
dgfgfdagasdfgfa 9y ago
You missed the hedge phrase—"pretty much". Obviously there isn't such a thing as a guarantee for security, but there are counterexamples for most OSs. Do you have one for the current iOS version? I haven't seen someone jailbreak their phone since iOS 5, I think, though people did do it since then. What's the point of your critique when you can apply it to literally any piece of software? Even SEL4 relies on a correct processor, and yours has flaws.
simonh 9y ago
'Pretty much' guarantees. I switched to Macs back in 2007. I work in IT, have always been careful to install anti virus software on Windows machines and showed my family how to avoid click bait and dangerous downloads. Even so I frequently used to have to clean malware off my old Windows machines. We do have one windows laptop on Windows 7 which is lightly used and most recently it got infected with a Firefox toolbar extension thing a few years ago that took a week to get rid of completely. I have never once since 2007 had to deal with a single piece of malware on any of our Macs. I know it exists, Handbrake downloads got infected a while back, but the difference is night and day. In my experience Mac OS is dramatically safer than even a fully up to date Windows machine with top tier virus protection software installed. Maybe that's changed with recent versions of Windows. Cool. Actually the only thing that drives me potty about Macs is the keychain getting corrupted, drives me potty.
kalleboo 9y ago
Nobody can guarantee their software is secure (secure software doesn't exist), but the cash value of a sandbox escape/jailbreak of iOS on the black market (or probably even through Apple's bug bounty) far exceeds the value that would be generated from some adware or cryptolocker scam all but guarantees that you won't see any widespread malware.
- mysterypie 9y ago
  > cash value of a sandbox escape/jailbreak of iOS on the black market...guarantees that you won't see any widespread malware Why would the black market pay huge sums for a sandbox escape or jailbreak -- unless it's for malware? If the answer is "for use by intelligence agencies", well that's malware by any reasonable definition.
tluyben2 9y ago
With all the security hetze and Apple pushing iOS as mainstream OS, I still do not get why this security depends on software and not hardware. Make it impossible for apps to break out of its jail at a hardware level.

valine 9y ago

For all practical purposes its true. There has never been a major malware outbreak on iOS, and iOS has never been more secure than it is now. A while back Apple started pulling anti-virus apps from the app store presumably because they aren't needed: https://9to5mac.com/2015/03/19/apple-app-store-antivirus/ https://9to5mac.com/2015/03/19/apple-app-store-antivirus/. For contrast here is Microsoft's official article on protecting your PC from viruses: https://support.microsoft.com/en-us/help/17228/windows-protect-my-pc-from-viruses https://support.microsoft.com/en-us/help/17228/windows-prote... In addition, about 80% of iPhones in use are running the latest version of iOS. Apple can patch exploits and have the majority of iPhones secured in a short amount of time. iOS is unique in that respect, and that is just one mitigating factor that makes iOS malware very implausible.

Chaebixi 9y ago
That's just marketing hype mixed with a little bit of goalpost moving. "Has never been more secure than it is now" != secure. > A while back Apple started pulling anti-virus apps from the app store presumably because they aren't needed. I think you presume too much. An effective antivirus program cannot run in a sandbox that isolates it from other processes. If Apple pulled 3rd party antivirus apps, I bet it was because they could not both work as advertised and simultaneously obey the sandbox, not because they "aren't needed" (presumably because the platform is "secure"). As for your original statement: >> You can't get viruses on iOS unless you're jailbroken - Apple's walled garden pretty much guarantees that. Here's a counterexample: https://www.kaspersky.com/blog/pegasus-spyware/14604/ https://www.kaspersky.com/blog/pegasus-spyware/14604/
- deleted 9y ago
  [deleted]
- valine 9y ago
  Pegasus was used by governments to target specific individuals. If you're being targeted by governments I would agree you're out of luck even on iOS.
  - Chaebixi 9y ago
    So, in other words, iOS is insecure and vulnerable to malware. Governments don't have special hacking powers, they mainly have money and manpower. It's true, iOS might raise the bar a little bit compared to some other systems, but IMHO it's misleading and dangerous to claim that it's invulnerable.
    - valine 9y ago
      The point is you're not going to get malware if you open the wrong email or go to the wrong site like you could on Windows. The organizations with enough resources to hack iOS devices aren't interested in sending mass emails to steal bank account details. The average iOS user who keeps their device up to date simply doesn't have to worry about malware and suggesting otherwise is misleading.
      - Chaebixi 9y ago
        > The organizations with enough resources to hack iOS devices aren't interested in sending mass emails to steal bank account details. The average iOS user who keeps their device up to date simply doesn't have to worry about malware and suggesting otherwise is misleading. Again, no. Here's another counterexample (which is recent and appears to have been active on the App Store for ~1yr): https://researchcenter.paloaltonetworks.com/2016/03/acedeceiver-first-ios-trojan-exploiting-apple-drm-design-flaws-to-infect-any-ios-device/ https://researchcenter.paloaltonetworks.com/2016/03/acedecei... "These malicious iOS apps provide a connection to a third party app store controlled by the author for user to download iOS apps or games. It encourages users to input their Apple IDs and passwords for more features, and provided these credentials will be uploaded to AceDeceiver’s C2 server after being encrypted." That's not state actor stuff. However, I shouldn't have to keep providing counterexamples to convince you of your absurd claims of practical invulnerability. Apple has not made any kind of security quantum leap: no one has. Apple's systems are vulnerable to the same types of flaws, by the same types of attackers, as any other system in wide use. The main difference is that Apple has restricted their platform to the extent they have an easier time implementing security best practices. iOS is still vulnerable to flaws Apple doesn't know about or hasn't patched, and those flaws can be exploited for as long as Apple remains unaware or fails to act. That's not fundamentally different position from Microsoft, Google, or any other similar company.
StillBored 9y ago
There is plenty of iOS malware, its just burred behind a "free" app which appears to be a simplistic game or whatever..
- djrogers 9y ago
  Citation? AFAIK the iOS sandbox has not been broken on un-jailbroken iOS devices, so at worst you're getting a garbage app that doesn't do what it promises. I've never seen nor heard of any actual malware outbreak from a non-jailbroken app.
  - 1ris 9y ago
    I know next to nothing about iOS, so: Why can't the (usually public) jailbrake-exploit or another, similar potent (and probably quite expensive) be launched from inside the app? Sure, it has to be hidden to get into the store, but that looks very easy compared to finding the actually jail break. One just has to hide a arbitrary code execution vuln in the code of the app somewhere. So, every apps seems to be an attack sureface.
    - valine 9y ago
      If there was a jailbreak available, yes. But there hasn't been a publicly available untethered jailbreak since March of 2016, and there has never been an untethered jailbreak of iOS 10. The only jailbreak for iOS 10 was semi-teathered and only made public after Apple had patched the vulnerabilities. In order for this to work as malware the user would have to open the malicious app every time their phone restarts. Not only that, every time the they open the app their phone would appear to be out of storage and then promptly crash to the boot screen. It would be a bit of a hard sell.
  - StillBored 9y ago
    Maybe I should have put malware in quotes. I was generally referring more to the privacy invading, battery sucking, ad displaying, etc behaviors of the vast majority of applications. Which per wikipedia (and traditional usage of the term) makes them malware. Apple/etc seem to be suck in the mindset of the various antivirus products before the advent of adaware/etc. So the products aren't strictly virus/trojans/worms/etc but they definitely fit the definition of malware and the end results are potentially just as bad. I would actually prefer any number of virus's over the some of the shenanigans the facebook app has been accused of.
deleted 9y ago
[deleted]

oneplane 9y ago

While there is of course no guarantee, most of the shitstained-OS-installations that were (or still are?) so common, with symptoms like non-functional systems, ads popping up, or having 90 toolbars are due to user actions. Sure, there are methods to deliver and elevate malware, but most of the 'problems' people experienced (before widespread banking malware) were practically "cosmetic" and "slowness" and almost always due to users randomly downloading and executing anything in their path. With iOS, that pattern is a lot harder to abuse, and with enforced sandboxing, side-effects between programs (or, 'apps') are somewhat non-existent. Most of the things that make non-Windows systems less infected seem to either be due to a better security design, less casual users or a drastically lower market share making it a smaller target with possible less effective organic spreading of malware. (or possibly a combination of the three)

dgfgfdagasdfgfa 9y ago

You missed the hedge phrase—"pretty much". Obviously there isn't such a thing as a guarantee for security, but there are counterexamples for most OSs. Do you have one for the current iOS version? I haven't seen someone jailbreak their phone since iOS 5, I think, though people did do it since then. What's the point of your critique when you can apply it to literally any piece of software? Even SEL4 relies on a correct processor, and yours has flaws.

simonh 9y ago

'Pretty much' guarantees. I switched to Macs back in 2007. I work in IT, have always been careful to install anti virus software on Windows machines and showed my family how to avoid click bait and dangerous downloads. Even so I frequently used to have to clean malware off my old Windows machines. We do have one windows laptop on Windows 7 which is lightly used and most recently it got infected with a Firefox toolbar extension thing a few years ago that took a week to get rid of completely. I have never once since 2007 had to deal with a single piece of malware on any of our Macs. I know it exists, Handbrake downloads got infected a while back, but the difference is night and day. In my experience Mac OS is dramatically safer than even a fully up to date Windows machine with top tier virus protection software installed. Maybe that's changed with recent versions of Windows. Cool. Actually the only thing that drives me potty about Macs is the keychain getting corrupted, drives me potty.

kalleboo 9y ago

Nobody can guarantee their software is secure (secure software doesn't exist), but the cash value of a sandbox escape/jailbreak of iOS on the black market (or probably even through Apple's bug bounty) far exceeds the value that would be generated from some adware or cryptolocker scam all but guarantees that you won't see any widespread malware.

mysterypie 9y ago
> cash value of a sandbox escape/jailbreak of iOS on the black market...guarantees that you won't see any widespread malware Why would the black market pay huge sums for a sandbox escape or jailbreak -- unless it's for malware? If the answer is "for use by intelligence agencies", well that's malware by any reasonable definition.

tluyben2 9y ago

With all the security hetze and Apple pushing iOS as mainstream OS, I still do not get why this security depends on software and not hardware. Make it impossible for apps to break out of its jail at a hardware level.