Android has more malware, but iOS apps pose greater risk of leaking user data, says study

Most people believe that Android is a more vulnerable platform from a security point of view, and they would be right. Android gets the king’s share when it comes to malware, but that does not necessarily mean it’s the less secure platform.   At least that’s what Appthority, app risk management firm, says in its new report. Based on a study of the top apps on iOS and Android, Appthority says that more top apps on Apple’s platform are likely to leak your personal information to others. “Yes, there are hundreds of thousands out there that won’t cost you a cent to download. But they still extract a price. The price, at a minimum, is information — about you. As more than one expert has said, “You are the payment.” And that payment is not risk-free,” Appthority says in a report released last week.   The company spoke about the rise of malware in the aftermath of the Mobile World Congress but its Winter 2014 App Reputation Report makes for a more interesting reading. Appthority says it analysed 400 apps - the top 100 free and top 100 paid - for iOS and Android for risky behaviours and found that most leaked users’ personal data. Surprisingly in over 2.3 million apps analysed by the company, less than 0.4 percent had malware, but 79 percent posed a data leak risk, which is more threatening for the average consumer and enterprise users.   A massive 91 percent of the top iOS apps posed a risk of data theft, while the corresponding figure for Android was 83 percent. Ninety-five percent of the top 200 free apps 80 percent of the top paid apps on iOS and Android posed a risk.   Of the free apps, 70 percent allowed location tracking, 56 percent identify the user’s ID and device, while another 31 person have access to contact. A massive 69% use single sign-on, which means that they get linked IDs, while more than half the apps analysed shared data with ad networks and analytics.   Apps identify users even though Apple has clearly stated that they cannot do so. Apple says developers must not request a UDID to track users, Appthority says, “However, 26% of top iOS apps still make requests for UDID, and on any device that is running an older OS than iOS7, the apps are still able to get the UDID directly from the device,” Domingo Guerra, cofounder and president of Appthority.   In-app purchases are another area where developers could possibly exploit users. More than half the top apps offered in-app purchases which can lead to financial data being leaked. “Apps are generally collecting more information than they need,” Guerra said. “Why does a flashlight app need my location, calendar, and address book? The issue this creates is that these databases are not always built securely and can become targets for criminals or governments.”