Applications 226 days ago | | 12 Comments

Review: How secure is your mobile data – what options do you have?

mobilesec

Editor’s Note: This is a comparison between two paid security softwares, and not of the many free options. Some of which are Cerberus, Lookout, Prey and Where’s My Droid, which we at Android Australia highly recommend if you’re not after a paid version.


Written (beautifully) by Richard Taylor.

What do you have stored on your mobile? Phone numbers and addresses? Your ATM PIN in a text file because you can never remember it? Passwords to various web sites? Business and personal email messages?

As mobiles and tablets get more powerful, we use them more and more like personal computers. The difference is, these devices come everywhere with us. Unfortunately their small size and portability is also their biggest downfall in terms of data security.

WHAT IF THEY REALIZE THE VALUE OF THE DATA THEY HOLD? THAT ATM PIN. PHONE NUMBERS…

No matter if you leave your phone on a table at a café, in a cab, or it’s stolen from your bag its loss can have serious consequences. A thief might do no more damage than make a few international phone calls or try to sell your phone, but what if they realize the value of the data they hold? That ATM PIN. Phone numbers of your clients. Notes from the business meeting you just attended.

Just how secure is your mobile? Android’s face lock feature is known to be insecure with even a simple photo fooling it. A 4 digit PIN can be guessed easily, especially if the thief also grabbed your bag with other personal information to give them clues to what your PIN might be. Password protecting your device is the first step, but that won’t help against the growing mobile virus threat.

Some threats come as part of apps that actually contain malicious code. Others arrive via text messages, and replicate themselves by replying to incoming messages with an infected attachment. Yet more are dispersed via QR codes or NFC chips that tell your phone to download a malicious file.

Sidebar: Quick Response (QR) Codes

The popularity of QR codes in Australia is increasing. We are seeing them on billboards, in newspapers and magazines, in store catalogues and even on web sites. They are a way for people to convert a web link into a bar code that can easily be scanned and processed by a user simply by taking a photo of the code on their phone.

They are fast, convenient and dangerous! Used in combination with link shortening, it can be very difficult for a user to know in advance if the code is safe to use or what site the code will open.

QR codes have already been used to install Trojans on Android phones. They generally trick the user into spreading the Trojan by downloading an ‘update’ to some software or clicking a button to prove you’re human. Once installed on your device, the Trojan is then able to send messages to your contacts.

Because Android is a relatively open platform, it is easier for malware developers to write and distribute applications. Android’s increasing popularity is another major drawcard to these nefarious developers.

According to Symantec, over 13,000 malicious Android APKs (application packages) have been identified to date with around 10,000 of those identified just this year.

Symantec’s data shows that more than half of all Android threats collect device data or track users’ activities. Almost a quarter of the mobile threats identified in 2011 were designed to send content and one of the most popular ways for phone malware authors to make money is by sending premium SMS messages from infected phones. This technique was used by 18% of mobile threats identified in 2011. Increasingly, phone malware does more than send SMS. For example, attacks that track the user’s position and steal information.

Key Functionality Of Mobile Risks

Recognising the growing need to protect handheld devices, two of the big guns in desktop security also have products for mobile and tablets:

  • Symantec offers two products: Norton Anti-Theft and Norton Mobile Security
  • Kaspersky has their Mobile Security product
Kaspersky Mobile Security Norton Mobile Security Norton Anti-Theft for Mobile and Tablet
Remote Locate SMS Web or SMS* Web or SMS
Remote Lock SMS Web or SMS* Web or SMS
Remote Wipe SMS SMS* -
Lost Notice - Yes Yes
Photo of User - Yes Yes
Call & Text Filter Yes Yes* -
Trusted Unlock Numbers - Yes* -
SIM Lock Yes Yes* -
Fraudulent (Phishing) Web Protection Yes Yes -
Download File Protection Yes Yes -
Full File Scan Protection Yes Yes -
Uninstall Prevention Yes Yes -
Android Version 2.2 or later 2.2 or later 2.2 or later
Annual Subscription AU$49.95 per device AU$29.99 per device AU$49.99 up to 3 devices

*Hardware Dependant 

As you can see above, the feature offering from both Kaspersky and Norton’s mobile security product is fairly similar, but what do all those features mean?

REMOTE LOCATE

As the name suggests, this allows you to locate your device if it is lost or stolen. Depending on your device and which product you purchase this can be done via SMS and web site.

 

REMOTE LOCK

This lets you use the web site or send an SMS to remotely lock your device. Great if you know where it is but don’t want to run the risk of anyone getting to your data before you can retrieve it.

REMOTE WIPE

If you’re worried about the data stored on your device, both vendors allow you to send an SMS that will erase all data including data on an SD card.

LOST NOTICE

This feature allows you to display a message on your device. You could send an alternative contact number if someone finds your device or post a reward message.

PHOTO OF USER

One of the more intriguing features of the Norton products is called “Sneak Peek”, you can take a photo of whatever the forward-facing camera sees. This can be done manually or automatically every 10 minutes when you have put the device in ‘lost mode’. Combine this with the locate feature and you could have some great information to give to the police in case of theft. I’m not sure how they will go getting my Galaxy Note back from a zombie…

CALL AND TEXT FEATURE

A feature from both Kaspersky and Symantec, this lets you set up a “black-list” of numbers you don’t want to receive calls or texts from.

TRUSTED UNLOCKED NUMBERS

This is another useful feature from Symantec. You’ve lost your phone and sent the lock command to it, then realise it was stuck behind the sofa cushion the whole time. By setting up to three trusted numbers (friends or family) you can send an unlock command from their phone to reactive yours.

SIM LOCK

If a thief tries to change the SIM in your phone, this feature will instantly lock the device, rendering unusable (and unsaleable).

FRAUDULENT (PHISHING) WEB PROTECTION

We’ve all seen the scam emails, the sites that are almost, but not quite right. This feature will prevent you from browsing to known fraudulent web sites, helping you protect your data.

DOWNLOAD FILE PROTECTION

Automatically scan apps and app updates you download to ensure there is no malicious code or viruses.

FULL FILE SCAN PROTECTION

No matter how careful you are, rogue files can slip through. Especially if you transfer files from your computer or have rooted your phone for custom files and ROMs. Both vendors offer the ability to scan your entire device, including SD card either on a schedule or when you choose to press the button.

UNINSTALL PREVENTION

Worried that a thief will simply delete your chosen protection? This feature requires you to enter a passcode into the software before it can be deleted. Sure a savvy thief could wipe your phone in other ways, but hopefully you’ll be able to track it or wipe it yourself before that happens.

With both Mobile Security versions offering a similar feature set for mobiles, it was difficult to see where one product was better or worse than the other.

      

Neither product noticeably slowed down my device and both scanned downloaded applications quickly and without fuss, the big difference I did notice was the time required to do a full scan of my phone including the SD Card.

After 20 minutes, Kaspersky was reporting that it had scanned less than 25% of the total files. I tried to do a full scan a number of times, but as you can’t use your device with either product when a full scan is in progress, it never got to complete. By contrast, Norton Mobile Security reported a full anti-malware scan complete after less than 6 minutes and found a suspicious file in the process.

If you’re like me and own a computer (or two), a mobile, and a tablet, both companies have you covered

Norton One 360 Multi-Device and Kaspersky One. These offer multi-device protection for computer, mobile and tablets at a lower cost than buying individual licenses for each.
Norton 360 Multi Device Kaspersky One
Windows XP Yes Yes
Windows Vista Yes Yes
Windows 7 Yes Yes
Mac OS 10.7+ 10.5 – 10.7
Android Mobile 2.x and higher 1.6 – 2.3, 4.0
BlackBerry No 4.5 – 6.0
Symbian No Symbian^3 or Series 60 9.1, 9.2, 9.3, 9.4
Windows Mobile No 5.0 – 6.5
Android Tablet 2.x and higher 2.2 – 4.x
5 Devices Per Annum AU$129.99 AU$159.95

So which should you choose? It’s a tough race and is very hard to pick a winner. For me the speed of the scan and the trusted number unlock feature (perfect if you just left your device at a known location and can retrieve it later) tipped the balance in Norton’s favour.

Disclaimer: Both Symantec and Kaspersky provided licensed copies of their products for review.

About the author: A self-proclaimed geek, Richard been involved in the IT industry since 1984 working in an Apple reseller the year the Macintosh was launched and personal computing history was made. He is keenly taking part in the revolution that the convergence of devices and the rise of social media are creating in the fields of communication and collaboration for both personal and business connections.

Written by : This post is made by a guest author for Android Australia, who may soon become a part of the team.
  • Mysterious Guy with a Hat

    What about Sophos mobile security?

    • http://androidaustralia.com.au Josh Berg

      This is an insight into mobile security and two viable options that we had access to. I personally don’t know too much about Sophos though, do you use it?

      • http://androidaustralia.com.au Josh Berg

        P.S. – I love your account name. :-)

    • http://bryce.se Bryce Adams

      I’ve heard it’s pretty mysterious software

  • gurgle

    Um, fear-mongering much? I’m sorry but this article reads like straight up antivirus propaganda.

    As long as you preview the link from a QR code it’s about as ‘dangerous’ as any other link on a webpage. Writing off the whole technology because it might link to dodgy sites is just ignorant.

    If you rely on the Play Store and don’t sideload apps, the everyday user hardly need antivirus on an Android phone. As Google engineer Chris DiBona stated:

    “If you read an analyst report about ‘viruses’ infecting ios, android or rim, you now know that analyst firm is not honest and is staffed with charlatans. There is probably an exception, but extraordinary claims need extraordinary evidence”

    Keep a good eye on the permissions of apps you install from the play store, don’t pirate apps (duh) and only side load apps you’re certain are legit and you will NOT need virus protection.

    There are loads of free, awesome apps on the play store that do a great job of locking and recovering you phone if it is lost. Checkout Prey – and Wheres My Droid.

    Paying up to $50 dollars for those apps is GODDAMN CRAZY.

    • http://androidaustralia.com.au Josh Berg

      I agree with you for most of what you have said. For many of us, security is not needed. If you take care to read permissions, never tick the ‘unknown sources’ box (unless you know what you’re doing) and don’t side-load apps then the everyday user will not need it.

      However, I think that for an average user that wants to make sure they’re safe – one of these apps would help them out (it also comes with cross-security on your computer). I know that when I show people what their Android can do, I’m often saying ‘just make sure you don’t do this’ or you could harm your phone. I think that the security of feeling safe in this sense would be good for certain people.

      But yes, I do agree and feel that most of us reading this article will not necessarily need to load up some security on our phones. But, keep in mind that this software is cross-platform too.

      I don’t think the author is writing off NFC though, but rather saying that it has the potential to be dangerous. While it is generally completely safe, it can have some issues – though very rare.

      Paying $50 for these apps may be considered crazy, but so may paying ~$1000 for an iPhone over an equally capable (and cheaper) Android. But, people do it.

      • gurgle

        Respectfully, I think preying on the Fear, Uncertainty and Doubt (FUD) around viruses on Android phones is just shady. Sure ‘peace of mind’ is good for some people, but in my opinion it’s wholly unnecessary.

        • http://androidaustralia.com.au Josh Berg

          Agreed. I don’t usually recommend these applications to anyone, but rather inform them of free versions (or none!). But as I said I think that this works well for some people.

          • gurgle

            Agreed.

            PS thanks for tidying up the links in my comment! Is there a way we can format it when commenting it so they come out nice?

    • Cam Charles

      all comes down to your level of understanding of tech really, like all other platforms those that end up with the virus’s and such aren’t often the techie high level users, the average user doesn’t know the traps and gets caught alot more then you would think so there is a legitimate market out there that should be protected and should be wary of QR codes etc, which whilst aren’t anymore dangerous then other phishing links are the “scam of the day” danger point atm

      that being said i would pay anywhere near these amounts especially with so many free equals out there

      • http://androidaustralia.com.au Josh Berg

        Would or wouldn’t? ;-)

  • http://artywah.info artywah

    I don’t particularly think this is fear mongering. There are trojans out there and for those who aren’t very tech savvy it’s relatively easy to get one, just as it is on a desktop computer.

    Be it from a QR code with a short URL so you don’t know the final destination, a dodgy app (from the Play Store or elsewhere) or if you have installed apps via another means it is possible your device will get infected and you won’t know.

    As I said in the article, the Norton product found a potential issue on my phone, and I’m fairly careful with what I install.

    For me, the security of my information on my computers and mobile devices is worth $130/annum to cover all of them. If you don’t think your data or the data is worth protecting, then that’s absolutely your call and I won’t try to convince you otherwise.