I just bought an Android tablet after living exclusively in the Apple iOS world for the past couple years. The cost of the cheaper Android tablet was great, and my geek side surely will enjoy the customization options in the days ahead. However, what I do not look forward to are potential security issues.
All of the reports in recent years have exposed the fact that the Android environment is more susceptible to being compromised than IoS, however, recently even that is becoming a matter of degree as cracks in the Apple armor have been exposed. The one as somebody who is in the tech industry and tries to be vigilant that should make us Android users be somewhat concerned is the Stagefright vulnerability which hopefully will not make it into the wild.
To be frank, Stagefright is pretty scary. Anyone with an Android mobile device who is vulnerable to the exploit should be thinking about it, and that’s roughly close to 1 billion devices at last count. What makes Stagefright so frightening is that it isn’t just a malware exploit that cause significant grief. In what might be considered a perverse flip side of ease-of-use, Stagefright is unfortunately about ease-of-infection. It loads itself onto an Android device with nothing more than an MMS message. A message with a carefully crafted media attachment can infect the Android device without any user intervention.
As noted in a recent Alcatel-Lucent blog post, Android Vulnerability Stagefright Highlights Need for Increased Focus on Security, by Kevin McNamee, Director, Motive Security Labs, Alcatel-Lucent, vulnerabilities like this are a ringing endorsement for network-based malware detection systems such as Alcatel-Lucent’s Motive Security Guardian. Putting aside the highlighting of Alcatel-Lucent’s unique offering in this space, McNamee does make a compelling argument as to why despite device-based anti-malware, the only way to effectively stop Stagefright and similar types of malware attacks is at the network level.
As McNamee explains, most malware communicates over the network, between the device and the hackers’ command and control servers. It is this communications that only a network provider can detect and respond to quickly. He also notes, the issues with Android make it that much more important for service providers—caught amid Google, the device manufacturers and the end consumer in terms of distribution of updates that will protect the devices—to leverage their positions as positive men in the middle.
They can identify malware flows across the network and alert users if a device has become infected. This is good for keeping users safe rapidly and also goof for the operator as traffic from malware-infected mobile devices can quickly become a network burden on several levels bringing service down to intolerable levels or even a halt.
The interesting thing about the attention that has been paid the Stagefright vulnerability is that it not only shined a light on a nasty security vulnerability that we all must be aware of, but also does illustrate an opportunity for the mobile service provider to become part of a holistic security solution for the mobile subscriber. After all, such network-based malware detection can be not just a revenue opportunity for operators, but one that subscribers are likely to willingly pay a premium for.
While most customers don’t think about mobile device security now, it would be easy enough to change that with a marketing campaign and a few particularly horrendous malware outbreaks such as Stagefright. Especially if the industry has an actionable response like a network-based security service subscribers could purchase.
My new Android tablet is nice so far—but it does have its downsides. Security is one of them, but it appears that with a little vigilance on my part, and that of my service provider if they are willing, that I can rest a bit easier with my decision to switch from iOS.
