Ben Thompson, wordsmith behind my favorite tech business column Stratechery, included a bit this week on the bonkers new Android security flaw. He discusses, in fairly objective words, the difference between Android's market share and Apple's security measures.
Before I quote his words below, now's a good time to remark that I'm really glad Apple's HomeKit is taking so long, if the reason really is because they're making security a huge, annoying priority. Bluetooth isn't secure. Apple's bending-over-backwards -- and making developers and, notably, HomeKit hardware manufacturers -- fix it before it's an issue. Lights that know when you're home are one thing, locks on your door and cameras are another.
From Stratechery:
“Android is the most popular mobile operating system on Earth: About 80 percent of smartphones run on it. And, according to mobile security experts at the firm Zimperium, there’s a gaping hole in the software — one that would let hackers break into someone’s phone and take over, just by knowing the phone’s number.
In this attack, the target would not need to goof up — open an attachment or download a file that’s corrupt. The malicious code would take over instantly, the moment you receive a text message…
Here’s how the attack would work: The bad guy creates a short video, hides the malware inside it and texts it to your number. As soon as it’s received by the phone, Drake says, “it does its initial processing, which triggers the vulnerability.”
The vulnerability is slightly less bad than it sounds: Hangouts processes the video instantly, but the default Android messaging app only processes the video if you view the message, leaving users at least a chance of avoiding the exploit. And, of course, Google has already issued a patch.
There, though, is the catch: as is well-documented at this point, most patches don’t make it to existing smartphone owners. They first have to be adapted and pushed out by device manufacturers and then by carriers, neither of which (particularly device manufacturers) have much of an incentive to get updates out the door. The result is that it’s fair to assume that most Android devices in the wild will remain vulnerable to this exploit.
Of course, iPhones famously don’t have this problem because Apple has dictated terms with carriers that ensure they are in charge of pushing out updates (and they are the device manufacturer), which leads to two observations:
For all the (deserved) guff that Apple gets about security, the real life implication of their business model is that they are, by a long shot, the most secure vendor serving customers in volume. I think that there is something very profound in that fact: paradigm shifts can be worth far more in practice than slavish adherence to best practices in theory
I suspect security has the potential to be far more effective for Apple from a marketing perspective than is privacy, with the added benefit that duplicitousness is unnecessary. And, of course, it has worked before.
More broadly, as always it remains the case that strengths and weaknesses are two sides of the same coin. The reasons why Android is so hard to patch are the exact same reasons why Android is everywhere; more subtly, the reasons why iPhones are better from a security perspective for normal people are directly connected to why it is that Apple drives security researchers batty. Everything is a tradeoff.”