Comparison of iOS and Android Security Features The following table summarizes some of the important differences between iOS and Android devices mostly with respect to the available security features. Table 1 – Differences between iOS and Android Feature iOS Android Comment Device hardware manufacturer Single hardware optimized for software Multi-vendors and custom network carriers iOS is capable of providing a of optimization and more agile update model since there is one single hardware and software manufacturer. Trusted boot Trusted boot chain in all devices from low level Boot ROM up to app/firmware level Vendor-specific security features with different levels of assurance depending on the manufacturer and versions iOS with a single manufacturer for hardware and software provides a higher level of assurance on average. Android in most cases can be rooted without many issues. Roll back to previous versions System software authorization prevents users to downgrade their systems Users are allowed to downgrade most of Android devices without many issues OS customization Single version for all device models and configurations. Multi custom OEM versions iOS is capable of reacting much faster to bugs since there is no need for porting the fixes to multiple vendors/carriers/etc. App distribution and installation Apple signs all apps and users cannot install from alternative sources, unless the device is jailbroken Google distributes apps but users are free to install apps signed and distributed even by e-mail directly by the developers Android users have a higher risk since they may inadvertently install malicious apps from any source Jailbreak and rooting Users can in some cases jailbreak their devices to run custom software not distributed through the Apple Store and Users in most of the cases can root their devices to have admin rights
have admin rights Custom ROMs iOS is closed source and there are no custom ROMs available. The bootloader cannot be unlocked since it relies on the signature of the firmware using Apple’s private key. Android allows custom ROMs and makes it possible because the system is open source and the bootloader can be unlocked Default system apps Apple controls all default installed system apps, which are the same for all different types of devices. Each OEM manufacturer and region may add to their devices their own custom system and pre-installed apps. Due to the higher number of possible customizations in Android there is a bigger attack surface or opportunity for vulnerabilities to be exploited. Memory and file system encryption Available by default with different classes of encryption to protect against direct flash storage access using forensic tools. Relies always on tamper-proof hardware support for storage of encryption keys and execution of encryption functions. Flash storage encryption is supported but depends on the device manufacturer. In most cases the storage of encryption keys is not tamper proof and secured by hardware. Android is far more vulnerable to attacks using forensic tools to read data even in devices with encryption enabled. iOS implements a level of security that even Apple in some cases is not able to circumvent. OS features Stripped down from basic commands, utilities, and shell. Most standard utilities are available and some are not protected by permissions. In Android an app can run a “ps” command to get the list of running processes and infer the installed app by the users without requiring any specific permission.