Apple makes the most secure phones in the world. At least, that’s the common assumption.



But increasingly Android models are as difficult, if not trickier, to break into as the iPhone, according to search warrants and forensic industry sources.



One&nbsp;<a rel="noreferrer noopener" href="https://www.documentcloud.org/documents/6024482-Angel-Angulo-Phone-Search-Warrant.html" target="_blank">warrant</a>&nbsp;unearthed by&nbsp;Forbes&nbsp;detailed a case in which cops seized an LG Android phone after swooping on suspected drug dealer, Angel Angulo, who’d allegedly sold methamphetamine to an undercover cop. Upon Angulo’s arrest the police obtained the phone from inside the his Ford Mustang, though the search warrant didn&#8217;t detail what exact LG model.



READ MORE | <a rel="noreferrer noopener" aria-label="The World’s Most Reputable CEOs 2019 (opens in a new tab)" href="https://www.forbesafrica.com/lists/2019/05/22/the-worlds-most-reputable-ceos-2019/" target="_blank">The World’s Most Reputable CEOs 2019</a>



The police obtained the LG in January and even had permission to force open the device by holding it up to Angulo’s face or depressing his fingerprint to unlock with facial or fingerprint recognition. 



But agents at the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) have not been able to find a way to bypass the lock screen with their current forensic tools and techniques. 



They&#8217;ve now asked for an additional 120 days to access the device, according to a&nbsp;<a rel="noreferrer noopener" href="https://www.documentcloud.org/documents/6024473-Cellebrite-Gets-Update-to-Help-Get-Android.html" target="_blank">filing</a>&nbsp;from the ATF. (No legal representation was listed for the defendant. The Department of Justice hadn’t responded to a request for comment at the time of publication).



READ MORE | <a rel="noreferrer noopener" aria-label="Huawei Lawyer Says CFO Meng A ‘hostage’ After US Presses Charges (opens in a new tab)" href="https://www.forbesafrica.com/current-affairs/2019/01/29/huawei-lawyer-says-cfo-meng-a-hostage-after-us-presses-charges/" target="_blank">Huawei Lawyer Says CFO Meng A ‘hostage’ After US Presses Charges</a>



iPhones less secure than Android now?



Sources in the forensics community tell&nbsp;Forbes&nbsp;that the security of Google’s operating system has become, in some cases, too strong to allow police (or anyone else with direct access to an Android phone) inside. “Some would say iPhones are less secure,” said one source from a large forensics provider.



Google, like Apple, has been continually adding security features to Android, said Vladimir Katalov, CEO of Russian forensics provider Elcomsoft. One of the key updates to Android over the years remains Secure Startup, which encrypts all internal storage so the data within should be accessible only to someone with a passcode or other form of authentication, like a face or a finger.



The anonymous source noted that a considerable amount of resources go into penetrating the defenses of iPhone operating systems, and once a hack works on one iOS device, it should work on all the others. The same cannot be said for Android, which is fragmented across manufacturers’ home-brew updates and countless phone models. If a police officer or forensics professional finds a way to break into a Google Pixel, for instance, the same hack might not work on any other devices.



READ MORE | <a rel="noreferrer noopener" aria-label="Google, Facebook, Twitter Fail To Live Up To Fake News Pledge (opens in a new tab)" href="https://www.forbesafrica.com/current-affairs/2019/02/28/google-facebook-twitter-fail-to-live-up-to-fake-news-pledge/" target="_blank">Google, Facebook, Twitter Fail To Live Up To Fake News Pledge</a>



“While some Android phones can be accessed using generic methods, each new model may contain unique features which require a more customized approach,” said Peter Sommer, professor of digital forensics at Birmingham City University in the U.K. “In addition there are instances of standard Android phones being heavily modified to have secure features.”



The issue of Android security is particularly pressing for Huawei, the world&#8217;s largest manufacturer of Android phones, which is&nbsp;<a href="https://www.forbes.com/sites/jaymcgregor/2019/05/22/huawei-disaster-will-impact-android-in-one-clear-way/" target="_blank" rel="noreferrer noopener">set to lose access to Google&#8217;s security updates</a>&nbsp;on newer devices. That’s because of the Trump administration’s ban on American companies doing business with the Chinese telecoms giant.



iPhone still trumps Android in some cases, though. When&nbsp;Forbes&nbsp;tested a range of Android phones’ facial recognition systems, there were clear disparities in the security of the technology across the different devices. A&nbsp;<a href="https://www.forbes.com/sites/thomasbrewster/2018/12/13/we-broke-into-a-bunch-of-android-phones-with-a-3d-printed-head/" target="_blank" rel="noreferrer noopener">3D-printed head was able to open all the Android phones tested</a>, but it worked much quicker and in all light conditions on a OnePlus 6, whereas Samsung and LG phones were tougher to crack.&nbsp;Forbes&nbsp;also tested Apple’s facial recognition with the fake head. In that case, it proved impenetrable.



&#8211;Thomas Brewster;Forbes Staff

960×0 (1)

Google Is Making Android As Difficult To Hack As iPhone—And Cops Are Suffering

Google&#8217;s <a href="https://www.forbes.com/sites/thomasbrewster/2017/03/22/google-android-government-surveillance-fight/" target="_blank" rel="noopener noreferrer">proud of its track record</a> in protecting more than one billion Android phones and tablets from malevolent hackers. But in the last 12 months, it&#8217;s been dealt a few blows, including the <a href="https://www.forbes.com/sites/thomasbrewster/2017/05/26/google-shuts-down-massive-ad-fraud-on-play-store/" target="_blank" rel="noopener noreferrer">biggest ad fraud to ever hit its mobile operating system</a> and the <a href="https://www.forbes.com/sites/thomasbrewster/2016/11/30/gooligan-android-malware-1m-google-account-breaches-check-point-finds/" target="_blank" rel="noopener noreferrer">most significant single theft of Google accounts</a> thanks to an Android malware called Gooligan.
Those alarming events were set off via networks of cybercriminals focused on the platform, where coders combine their technical skills with the will and financial backing of organized gangs. Sometimes, the latter group don&#8217;t even have to pay for the former&#8217;s digital tools. Sometimes, the technically-savvy types open their minds for free.
That&#8217;s just what a character calling himself Maza-In did just before last Christmas, when he or she posted an in-depth guide on the Exploit.in hacker forum for creating Android &#8220;bankers&#8221; &#8211; malware designed to steal bank login details from users of Google&#8217;s platform. The post not only included directions, but source code for a banker too. There was also a description of the required backend infrastructure, all of which combined could deliver realistic-looking bank pages designed to trick victims into handing over their usernames and passwords.
And now, Android security experts have <a href="http://blog.checkpoint.com/2017/05/16/the-mobile-banker-threat-from-end-to-end/" target="_blank" rel="noopener noreferrer">pinned</a> a spike in banking malware on Maza-In and that post. They claim that Maza-In, in one fell swoop, caused a sudden leap in Android banking fraud, as cybercriminals took that open sourced code and adapted it to spread both in and outside Google’s official Play store. According to an independent researcher going by the moniker <a href="http://b0n1.blogspot.co.uk/2017/05/tracking-android-bankbot.html" target="_blank" rel="noopener noreferrer">b0n1</a>, as many as 60 variants of malware containing the Maza-In banker have been pushed out into the wider world by hackers hoping to make some easy money.
<a href="http://www.forbesafrica.com/focus/2016/03/01/making-millions-paranoia/" target="_blank" rel="noopener noreferrer">Making Millions From Paranoia</a>
Check Point, which has been tracking the mini-explosion in Android bank fraud with ElevenPaths, a Telefónica security unit, told Forbes it had records of several dozen servers operating Maza-In&#8217;s malware, the largest of which controlled close to 3,000 bots. ElevenPaths said that, from Google Play alone, downloads of apps based on Maza-In&#8217;s code stood at above 10,000 and expected to rise, not to mention the number of downloads outside the store.
Those aren&#8217;t massive numbers. But what Maza-In and those who adapted his work for their own machinations have proven repeatedly are flaws in Google Play&#8217;s security, namely the Bouncer technology that&#8217;s supposed to keep bad apples out. Just two weeks ago, a sample of BankBot, based on Maza-In&#8217;s creation, was seen inside Google Play initially disguised as a video downloader tool. On June 13th, a very similar looking video downloader was up on the market; underneath was, again, a banker using Maza-In&#8217;s work. Going further back to April, a malware called Charger, which also borrowed heavily from Maza-In, was doing much the same, but masquerading as a flashlight app inside the official store, <a href="https://www.welivesecurity.com/2017/04/19/turn-light-give-passwords/" target="_blank" rel="noopener noreferrer">ESET reported</a>. All were removed from Google Play as soon as the tech giant was alerted, but not before thousands were infected.
&#8220;Before this Maza-In code, there were a lot of Android banking Trojans, for sure,&#8221; said ElevenPaths security researcher Sergio de los Santos. “But accessing the source code was not easy and this helps all kinds of people create variants and even get into Google Play. Giving a very simple and effective framework to create and manage your own banking Trojan opens the door to hundreds of profiles of attackers that want to get into business the easy way.
&#8220;Maza-in made it very simple to add different banks to attack, so you may see people from Latin America with their own samples focused on banks in there, UK people, Russians.&#8221;
A hacker responds
Maza-In says he is no cybercriminal, though. (As Maza-In uses a profile picture of Bob Marley, Forbes has chosen to refer to the hacker in the masculine). In an interview over encrypted chat, he said he only wanted to highlight weaknesses in Google’s operating system, not spawn a spike in Android cybercrime. He claimed, for instance, that despite security firms&#8217; claims he was behind the BankBot banker, another individual was responsible.
Yet he was aware of the criminal use of his code, revealing others, whether they&#8217;d given the malware additional features or not, were selling it for between $2,000 and $3,000 a pop on the web&#8217;s underground markets. &#8220;I did not expect it to work out that way, that it would spread so much,” he told me in Russian (translated by Google Translate).
&#8220;I did not write an article to harm people… I&#8217;m interested in studying the holey Android, since Google is not able to make a good operating system… by this I wanted to show the vulnerability of the Android and thought that Google would take care of security.&#8221; Unlike security pros who disclose bugs in return for credit or monetary reward, Maza-In said he didn&#8217;t contact Google.
<a href="http://www.forbesafrica.com/focus/2013/09/01/industrial-thief-line-can-rob/" target="_blank" rel="noopener noreferrer">Industrial Thief On The Line, How Can I Rob You?</a>
In describing just what he thought was wrong with Android security, he added: &#8220;The biggest problem is that the device can install any application, get full access to the device and can be substituted for fake banking applications [that can] intercept SMS [and] manage the device. In general, everything is possible.&#8221;
As for Check Point and ElevenPaths&#8217; assessment he was a malware creator supporting criminal operations, Maza-In said they&#8217;d exaggerated. He even claimed to be working on an Android anti-virus application.
But whilst analysts from both firms agree there&#8217;s no evidence he&#8217;s actively exploiting Android devices, they say it&#8217;s clear he is a malware creator who&#8217;s not followed best practise in highlighting security issues. &#8220;The blog contains explicit evidence that Maza-in is indeed behind the malware. He also boasted about his malware not being caught until January on one forum,&#8221; said Daniel Padon, mobile security researcher at Check Point. According to Lookout Mobile Security researcher Michael Flossman, Maza-In is just one handle used by a crew of Android fraudsters running all the aforementioned fraud malware.
&#8220;If you really want to show how unsecure Android is, you write an article about it, you code a proof of concept, you contact the right people to spread the word,&#8221; said de los Santos, explaining his disbelief at Maza-In&#8217;s claims to innocence.&#8221;But creating a Trojan? Oh, come on.&#8221;
Whatever the hacker&#8217;s involvement in the murkier parts of the internet, he and those who took advantage of his guide have given Google a headache. The company didn&#8217;t respond to requests for comment. But with the frequent appearances of these bankers on Google Play, it&#8217;s apparent the company has some work to do to keep ne&#8217;er-do-wells out of the market and users&#8217; Android devices. &#8211; Written by Thomas Fox-Brewster, FORBES STAFF

‘I Want To Expose Google’s Mistakes’: The Russian Hacker Blamed For A Big Android Fraud Problem

The last few years have seen an unprecedented number of people rushing to develop mobile apps for iOS and Android. But looking at the installed user base on each platform and information on the payouts made by the different companies, it appears that the vast majority of developers will find themselves with little revenue to show for.
Google, Apple, Microsoft : Rich in users, developers
The consensus around the industry is that Google dominates the mobile market with 900 million users, while Apple follows with 600 million iOS devices purchased, and Microsoft comes in third place with an estimated 12 million Windows Phones sold (the vast majority of those, 81%, being sold by Nokia).
With different forums aimed at attracting developers, each company handles announcing the size of their markets differently.
Apple, at its WorldWide Developer Conference, talked about 1.25 million apps in the app store accounting for 50 billion downloads and $5 billion paid off to developers in the last year. To the company, it is a sign of pride to be able to pay this developer community. Internal data from the app store, gathered from sources close to the company, indicate that the numbers are in line with the actual payments made to developers.
At Google I/O, the largest Android developer conference, Google touted 150,000 developers responsible for over 800,000 apps. While the company does not break out revenue numbers on their apps, recent data in their financial filings seemed to indicate somewhere around $900 million in pay-outs to developers “over the last 12 months” and discussions with external research analysts put the number of downloaded apps from the Google Play store at around 48 billion, close to what Apple has claimed.
Microsoft, meanwhile, has been claiming 160,000 apps in their store from 45,000 developers. In a recent interview, Microsoft officials claimed that the average user downloaded 54 apps, which would put their download count at 650 million to date. While the company does not break out data for its mobile division, looking at the variations in the accounts payable line of their 10-Qs over the last few quarters before and after they introduced their app store shows a variation of up to $100 million since 2011 that could be attributed to the app store.
So taking all that data into account, we can summarize it as follows:
Looking at this, it is clear that Apple is winning the game in terms of total number of apps and money paid to developers. But lost in the shuffle is how much money developers can actually make on those platforms.
Meager dollars per download
Taking the data in front of us, we can get a sense of how many apps the average developer creates and what kind of revenue a developer can expect from those apps, on ave-rage (granted, power laws dictate that a small number of developers will do extremely well while the vast majority will fail, but we’re trying to look at averages here).
Based on this, the average developer on those platforms is pretty busy, developing 3 to 5 apps depending on the platform. Interestingly, Android is the big winner on downloads for a given app but this is largely offset by substantially lower revenue, with the average app download bringing in around 2 cents to its developer; Apple fairs 5 times better, bringing in a dime for every one of the 40,000 potential app downloads a developer could strive for. But the interesting thing is that Microsoft’s platform may be substantially more rewarding for its developers, bringing in $.15 per download (a fact that is offset by download numbers shown to be only 10 percent of what the other platforms can offer).
With the average paid app retailing for $.99, what we see here is the direct impact of free apps on those marketplaces. Android’s substantial lead in offering free apps cuts deeply into the average revenue paid out to developers while the smaller availability of free apps on the Windows platform may work to its advantage.
But what does that mean in terms of actually revenue?
Impact on developers’ wallets
Multiplying the average revenue per app by its average number of downloads, we can get a sense as to what an average developer can expect to make on an app today. Taking the same number and multiplying it by the number of apps an average developer creates, we get a sense of the revenues one can pull from going that way:
What we see here is that while decent amounts of money can be made on an app, a hard-working developer on iOS will be able to get a new car, while Android and Microsoft developers will be forced into the used car market if they plan to take those earnings on the road. At $4,000 in average revenue per app, Apple has a lead but it still begs the question as to how many developers can actually make a living directly from apps on any platform. Direct revenue from the apps themselves may not be able to justify large development teams but other revenue sources (advertising, for example) may help developers increase their take.
Of course, these are average values and many hope to find the next big hit, the one that will be on the higher end of the median. But for every app that goes north of those numbers, the average for the remaining apps drop.
Where are the opportunities?
There is, however, some hope. While Apple has developed a rich market for developers, Google and Microsoft both have opportunities to improve. For Google, the focus should be on improving the numbers by helping developers monetize their apps so they can come more in line with what Apple can offer. Even if they only reached half of what Apple does in terms of revenue per download, they would be able to match the revenue developers make. For Microsoft, the story is all about the number of users. If they were to manage their average revenue per app while growing their user base, they could potentially out-earn all the other platforms.
In all three cases, however, there is much work to be done to increase monetization of free apps. And that may be the next growth opportunity for any developer as it presents an opportunity that is substantially larger than the existing one.
Every app developer hopes to build the next big hit but, as is the case for any hit-driven market, a large group will be left behind with little to show for their efforts. At the end of the day, the model for mobile apps is no different than any other of the past: whether it is gold in the Yukon, websites in the 1990s, or app developers today, larger amounts of revenue will go to those who enable development than to those who are doing the development. Levi Strauss made his fortune selling picks and shovels to gold prospectors; Adobe, Amazon, and Google made theirs enabling web developers; and as the mobile revolution takes hold, some new players will emerge providing tools to create apps and those may be the biggest winners.

Tag: Android

FORBES AFRICA SOCIAL MEDIA

Google Is Making Android As Difficult To Hack As iPhone—And Cops Are Suffering

‘I Want To Expose Google’s Mistakes’: The Russian Hacker Blamed For A Big Android Fraud Problem

How Much do average apps make?