How app stores make you safer -- to a point

The growth of app stores has neutralized many old-school malware threats, but it's introduced several risks too

Vendor app stores are quickly becoming nearly the only way people download and install programs to their devices. Android and iOS app stores surpassed 1.2 billion in downloads during the most recent Christmas season alone.

In general, app stores are a boon for computer security. Many devices are hard coded to accept downloads only from their corresponding app store -- Apple pioneered that model, not just with the App Store, but even earlier with iTunes. Plus, newer device platforms nullify decades of previous malware: What worked with traditional computers won't work with newer devices. Malware programmers not only have to learn the new APIs for the newer platforms to even begin the exploitation, they must learn the platform well enough to create a successful payload.

[ Also on InfoWorld: How to have BYOD and security, too | Security expert Roger A. Grimes offers a guided tour of the latest threats and explains what you can do to stop them in InfoWorld's Malware Deep Dive Report. | Learn how to secure your systems with InfoWorld's Security Central newsletter. ]

Not that learning the new way is hard -- heck, legitimate programmers are doing it quite well and creating hundreds of thousands of new apps. But the newness invalidates the old malware, and the learning curve naturally slows down existing hackers as they migrate. It's win-win for computer security.

Second, the new platforms use more secure programming languages, which have better safety features than their legacy counterparts. They have boundary checking, improved defaults, type checking, memory protections, and managed environments, leading to better-protected applications (all else being equal).

Third, the major app stores require that vendors submit their applications to a verification process to identify and eliminate common programming errors that could lead to compromises. Sure, app store programs can be and have been exploited, but the submission and expection process can only help to make more secure applications. There are many reasons to criticize vendors' inspection requirements, including the decrease of programming freedom, higher cost and effort, and censorship, but securitywise, it's a win.

After vendor approval, app stores often require a digital signature to ensure the program's integrity back to the identified vendor. For starters, the consumer can be more confident the application hasn't been maliciously changed, and the programmer is who they say they are. Also, if the programmer violates the terms, the vendor can easily revoke the application and even refuse all apps from the same developer in the future if necessary.

Fourth, app store applications tend to have quicker, more stable installations that follow a fairly common process. Further, the common install usually means there's a shared and seamless updating process. Security admins around the world should be applauding. Your end-user's application will automatically update with a minimum of hassle. This often extends to the operating system itself. Love it!

Fifth, those same applications are limited in what they can do, as they're sandboxed from the OS and from each other. It's harder, although not impossible (think Java) for malware to break outside the security sandbox. Today's devices and new OSes are fortunate to have learned from the lessons of Java and other legacy sandboxes.

Lastly, the newer platforms simply have fewer areas for malicious programs to infect. Traditional operating systems have more than 100 spots malware can exploit and hide, perfected by hackers over decades of battle -- fire up Microsoft's Autoruns utility to see what I mean. Fewer places to infect means fewer places to defend. That's another great benefit to decrease security risk.

1 2 Page
Mobile Security Insider: iOS vs. Android vs. BlackBerry vs. Windows Phone
Join the discussion
Be the first to comment on this article. Our Commenting Policies