Android has a reputation for being less secure than Apple’s iOS, but Google says its platform has gotten a bad rap. The company has released its fourth annual security report, a 56-page document
that details everything Google has done to keep Android users safe. The bottom line, according to Android security head David Kleidermacher, is that Android is actually just as hard to hack
as the locked down iOS platform.
Google has been talking a lot more about security lately, and that’s no surprise. Google’s newfound focus on hardening the platform traces back to a series of security scares in past years, most notably Stagefright in 2015. That breach resulted in a wave of security patches for phones and changes to the Android code base. In the wake of Stagefright, Google required all device makers to display the security patch level of a phone in its settings. It also began issuing security bulletins detailing all the issues included in its new monthly patches.
Not all device makers have been quick with rolling out security patches, but Google has other ways to keep phones secure. Last year, it unveiled Google Play Protect, which was a rebranding of the old Verify Apps system. This was more about perception — it wants users to know Google is on the lookout for bad apps
. According to the newly released report, Google’s machine learning tools spotted 60.3 percent of all potentially harmful apps in the Play Store. The remainder were discovered by other means. Google expects machine learning to play an even more prominent role in the future.
As we’ve pointed out
, a big reason Android is perceived as less secure is that users can manually permit the installation of apps from third-party app stores. That’s all you get in China because there’s no Google presence, and unsurprisingly, that’s where a lot of Android malware outbreaks begin. Without enabling “unknown sources” on your Android phone, the chance of picking up a harmful app is vanishingly small. In 2016, you had a 0.04 probability of downloading malware. In 2017, Google cut that number in half to 0.02 percent.
Google also cites its popular bug bounty program, which encourages developers and security researchers to hunt down bugs in its open source code. Those who find juicy vulnerabilities can get a big cash payout. Meanwhile, Apple keeps the iOS source code private, and bug bounties are anemic, so no one knows what sort of bugs may lurk inside. Anything particularly useful is more likely to be sold to private security firms than disclosed publicly. With Android, at least we know what’s going on.