Please forgive me for the impending wall of text, but I felt it was necessary to explain why the same 90% of all viruses and malware on Android have a near impossible time existing on Apple's OS's. If you take the time to read this information, you would see how Apple has really gone above and beyond to ensure iOS is the safest and most secure platform to be on. And it has little to nothing to do with Market-Share.
Malware developers are equal-opportunists. Their goal is to go for where there is great reward. The Apple eco-system is just that. There are more credit cards tethered to Apple accounts compared to every other platform per capita. Over two billion dollars more flow through the iOS ecosystem on an annual basis in direct comparison to Androids ecosystem, as users on the iOS platform have proven to be much more willing to pay for content through it. There's that much more incentive to steal user information from Apple's devices. However, it's not exactly the same thing as developing malware for Google's open-sourced OS.
Due to the tight integration of hardware and software on iOS devices like the iPhone, validation of activities across all layers of the device is possible right from the boot-up process. Bootloaders, the kernel, and the baseband firmware are all verified right from read-only memory. Since this code is placed in the Boot ROM during chip fabrication, it can be verified and signed securely without the risk that it has been tampered with. If, for some reason, this boot process is not working, the device is stopped and goes into recovery mode, requiring that you restore it to factory default settings using iTunes. The OS will actually "force-quit" applications carrying deviant code before its even recognized as malware, more less have the time to penetrate the system.
The System Software Personalization process is used to prevent iPhones and other devices from being downgraded from newer to older versions of iOS. There are obvious advantages to this, one being restricting the ability of an attacker exploiting a known vulnerability in an older version of iOS and gaining possession of the device after a downgrade. In addition, the company makes it possible for devices to be updated over-the-air (OTA), encouraging rapid adoption of security fixes. During an update, iTunes communicates with the installation authorization server and verifies certain parameters before signing it for approval. This chain-of-trust evaluation comes from Apple and is used to match the device's unique identity to ensure it qualifies.
The iOS kernel controls all user processes and applications that can run on your iPhone, iPad, or iPod Touch. To ensure that all apps come from an approved source, all executable code needs to be signed using an Apple-issued certificate. Developers are required to register and join the iOS Developer Program, which identifies the real-world developer before approval. This ensures that all applications in the App Store have an identifiable person behind them, which further deters attackers from creating malicious programs. To run in-house applications, you need to register with the iOS Developer Enterprise Program (iDEP) and be eligible. These apps are also restricted for certain users, which further discourages malicious activity.
Apple has enforced security measures to prevent this from ever happening. Third-party applications are restricted from accessing other application files or making changes to the device by a process called sandboxing. This involves assigning each application a unique home directory from where it can only use application programming interfaces (APIs) provided by iOS. Applications are also restricted in sharing data directly and are provided with key/value pairs that allow them only specific privileged operations that would otherwise require them to run as root. In addition, APIs limit background processing of applications, which reduces performance degradation. This also explains the phenomena of lesser spec'ed iPhones out-performing Android handsets with much higher specifications.
iOS devices implement file encryption in hardware using the device's unique ID and a cryptographic engine built between the flash storage and the main system memory. These are fused into the application processor during manufacture and cannot be read by any software directly. For devices using the A5 processor and above, there is an additional level of protection in place that protects against tampering during the installation and restore process. To avoid decrypting sensitive data during a phone call or other activity, Apple uses data protection technology in flash memory, which is built on the hardware encryption technologies in the device.
All of these discussed methods and techniques are things Android does not employ in any sense. Their OS is so back-bone raw, front, back and side doors wide open, that you have already seen how easy it was for every company to re-skin and re-configure Android all the way down to its very core to its own interests, to a point Amazon was even able to completely fork it into its very own OS. Mix in the fact that any developer can code and publish anonymously and there you have it. Less to do with market-share.
Log in to comment