7 ms·

For all practical purposes its true. There has never been a major malware outbreak on iOS, and iOS has never been more secure than it is now. A while back App

by valine 9y ago

For all practical purposes its true. There has never been a major malware outbreak on iOS, and iOS has never been more secure than it is now. A while back Apple started pulling anti-virus apps from the app store presumably because they aren't needed: https://9to5mac.com/2015/03/19/apple-app-store-antivirus/ https://9to5mac.com/2015/03/19/apple-app-store-antivirus/. For contrast here is Microsoft's official article on protecting your PC from viruses: https://support.microsoft.com/en-us/help/17228/windows-protect-my-pc-from-viruses https://support.microsoft.com/en-us/help/17228/windows-prote... In addition, about 80% of iPhones in use are running the latest version of iOS. Apple can patch exploits and have the majority of iPhones secured in a short amount of time. iOS is unique in that respect, and that is just one mitigating factor that makes iOS malware very implausible.

Chaebixi 9y ago
That's just marketing hype mixed with a little bit of goalpost moving. "Has never been more secure than it is now" != secure. > A while back Apple started pulling anti-virus apps from the app store presumably because they aren't needed. I think you presume too much. An effective antivirus program cannot run in a sandbox that isolates it from other processes. If Apple pulled 3rd party antivirus apps, I bet it was because they could not both work as advertised and simultaneously obey the sandbox, not because they "aren't needed" (presumably because the platform is "secure"). As for your original statement: >> You can't get viruses on iOS unless you're jailbroken - Apple's walled garden pretty much guarantees that. Here's a counterexample: https://www.kaspersky.com/blog/pegasus-spyware/14604/ https://www.kaspersky.com/blog/pegasus-spyware/14604/
- deleted 9y ago
  [deleted]
- valine 9y ago
  Pegasus was used by governments to target specific individuals. If you're being targeted by governments I would agree you're out of luck even on iOS.
  - Chaebixi 9y ago
    So, in other words, iOS is insecure and vulnerable to malware. Governments don't have special hacking powers, they mainly have money and manpower. It's true, iOS might raise the bar a little bit compared to some other systems, but IMHO it's misleading and dangerous to claim that it's invulnerable.
    - valine 9y ago
      The point is you're not going to get malware if you open the wrong email or go to the wrong site like you could on Windows. The organizations with enough resources to hack iOS devices aren't interested in sending mass emails to steal bank account details. The average iOS user who keeps their device up to date simply doesn't have to worry about malware and suggesting otherwise is misleading.
      - Chaebixi 9y ago
        > The organizations with enough resources to hack iOS devices aren't interested in sending mass emails to steal bank account details. The average iOS user who keeps their device up to date simply doesn't have to worry about malware and suggesting otherwise is misleading. Again, no. Here's another counterexample (which is recent and appears to have been active on the App Store for ~1yr): https://researchcenter.paloaltonetworks.com/2016/03/acedeceiver-first-ios-trojan-exploiting-apple-drm-design-flaws-to-infect-any-ios-device/ https://researchcenter.paloaltonetworks.com/2016/03/acedecei... "These malicious iOS apps provide a connection to a third party app store controlled by the author for user to download iOS apps or games. It encourages users to input their Apple IDs and passwords for more features, and provided these credentials will be uploaded to AceDeceiver’s C2 server after being encrypted." That's not state actor stuff. However, I shouldn't have to keep providing counterexamples to convince you of your absurd claims of practical invulnerability. Apple has not made any kind of security quantum leap: no one has. Apple's systems are vulnerable to the same types of flaws, by the same types of attackers, as any other system in wide use. The main difference is that Apple has restricted their platform to the extent they have an easier time implementing security best practices. iOS is still vulnerable to flaws Apple doesn't know about or hasn't patched, and those flaws can be exploited for as long as Apple remains unaware or fails to act. That's not fundamentally different position from Microsoft, Google, or any other similar company.
StillBored 9y ago
There is plenty of iOS malware, its just burred behind a "free" app which appears to be a simplistic game or whatever..
- djrogers 9y ago
  Citation? AFAIK the iOS sandbox has not been broken on un-jailbroken iOS devices, so at worst you're getting a garbage app that doesn't do what it promises. I've never seen nor heard of any actual malware outbreak from a non-jailbroken app.
  - 1ris 9y ago
    I know next to nothing about iOS, so: Why can't the (usually public) jailbrake-exploit or another, similar potent (and probably quite expensive) be launched from inside the app? Sure, it has to be hidden to get into the store, but that looks very easy compared to finding the actually jail break. One just has to hide a arbitrary code execution vuln in the code of the app somewhere. So, every apps seems to be an attack sureface.
    - valine 9y ago
      If there was a jailbreak available, yes. But there hasn't been a publicly available untethered jailbreak since March of 2016, and there has never been an untethered jailbreak of iOS 10. The only jailbreak for iOS 10 was semi-teathered and only made public after Apple had patched the vulnerabilities. In order for this to work as malware the user would have to open the malicious app every time their phone restarts. Not only that, every time the they open the app their phone would appear to be out of storage and then promptly crash to the boot screen. It would be a bit of a hard sell.
  - StillBored 9y ago
    Maybe I should have put malware in quotes. I was generally referring more to the privacy invading, battery sucking, ad displaying, etc behaviors of the vast majority of applications. Which per wikipedia (and traditional usage of the term) makes them malware. Apple/etc seem to be suck in the mindset of the various antivirus products before the advent of adaware/etc. So the products aren't strictly virus/trojans/worms/etc but they definitely fit the definition of malware and the end results are potentially just as bad. I would actually prefer any number of virus's over the some of the shenanigans the facebook app has been accused of.
deleted 9y ago
[deleted]

by valine 9y ago

Chaebixi 9y ago

That's just marketing hype mixed with a little bit of goalpost moving. "Has never been more secure than it is now" != secure. > A while back Apple started pulling anti-virus apps from the app store presumably because they aren't needed. I think you presume too much. An effective antivirus program cannot run in a sandbox that isolates it from other processes. If Apple pulled 3rd party antivirus apps, I bet it was because they could not both work as advertised and simultaneously obey the sandbox, not because they "aren't needed" (presumably because the platform is "secure"). As for your original statement: >> You can't get viruses on iOS unless you're jailbroken - Apple's walled garden pretty much guarantees that. Here's a counterexample: https://www.kaspersky.com/blog/pegasus-spyware/14604/ https://www.kaspersky.com/blog/pegasus-spyware/14604/

deleted 9y ago
[deleted]
valine 9y ago
Pegasus was used by governments to target specific individuals. If you're being targeted by governments I would agree you're out of luck even on iOS.
- Chaebixi 9y ago
  So, in other words, iOS is insecure and vulnerable to malware. Governments don't have special hacking powers, they mainly have money and manpower. It's true, iOS might raise the bar a little bit compared to some other systems, but IMHO it's misleading and dangerous to claim that it's invulnerable.
  - valine 9y ago
    The point is you're not going to get malware if you open the wrong email or go to the wrong site like you could on Windows. The organizations with enough resources to hack iOS devices aren't interested in sending mass emails to steal bank account details. The average iOS user who keeps their device up to date simply doesn't have to worry about malware and suggesting otherwise is misleading.
    - Chaebixi 9y ago
      > The organizations with enough resources to hack iOS devices aren't interested in sending mass emails to steal bank account details. The average iOS user who keeps their device up to date simply doesn't have to worry about malware and suggesting otherwise is misleading. Again, no. Here's another counterexample (which is recent and appears to have been active on the App Store for ~1yr): https://researchcenter.paloaltonetworks.com/2016/03/acedeceiver-first-ios-trojan-exploiting-apple-drm-design-flaws-to-infect-any-ios-device/ https://researchcenter.paloaltonetworks.com/2016/03/acedecei... "These malicious iOS apps provide a connection to a third party app store controlled by the author for user to download iOS apps or games. It encourages users to input their Apple IDs and passwords for more features, and provided these credentials will be uploaded to AceDeceiver’s C2 server after being encrypted." That's not state actor stuff. However, I shouldn't have to keep providing counterexamples to convince you of your absurd claims of practical invulnerability. Apple has not made any kind of security quantum leap: no one has. Apple's systems are vulnerable to the same types of flaws, by the same types of attackers, as any other system in wide use. The main difference is that Apple has restricted their platform to the extent they have an easier time implementing security best practices. iOS is still vulnerable to flaws Apple doesn't know about or hasn't patched, and those flaws can be exploited for as long as Apple remains unaware or fails to act. That's not fundamentally different position from Microsoft, Google, or any other similar company.

StillBored 9y ago

There is plenty of iOS malware, its just burred behind a "free" app which appears to be a simplistic game or whatever..

djrogers 9y ago
Citation? AFAIK the iOS sandbox has not been broken on un-jailbroken iOS devices, so at worst you're getting a garbage app that doesn't do what it promises. I've never seen nor heard of any actual malware outbreak from a non-jailbroken app.
- 1ris 9y ago
  I know next to nothing about iOS, so: Why can't the (usually public) jailbrake-exploit or another, similar potent (and probably quite expensive) be launched from inside the app? Sure, it has to be hidden to get into the store, but that looks very easy compared to finding the actually jail break. One just has to hide a arbitrary code execution vuln in the code of the app somewhere. So, every apps seems to be an attack sureface.
  - valine 9y ago
    If there was a jailbreak available, yes. But there hasn't been a publicly available untethered jailbreak since March of 2016, and there has never been an untethered jailbreak of iOS 10. The only jailbreak for iOS 10 was semi-teathered and only made public after Apple had patched the vulnerabilities. In order for this to work as malware the user would have to open the malicious app every time their phone restarts. Not only that, every time the they open the app their phone would appear to be out of storage and then promptly crash to the boot screen. It would be a bit of a hard sell.
- StillBored 9y ago
  Maybe I should have put malware in quotes. I was generally referring more to the privacy invading, battery sucking, ad displaying, etc behaviors of the vast majority of applications. Which per wikipedia (and traditional usage of the term) makes them malware. Apple/etc seem to be suck in the mindset of the various antivirus products before the advent of adaware/etc. So the products aren't strictly virus/trojans/worms/etc but they definitely fit the definition of malware and the end results are potentially just as bad. I would actually prefer any number of virus's over the some of the shenanigans the facebook app has been accused of.

deleted 9y ago

[deleted]