Smartphone OS market share vs. malware targeted at that OS
I was reading yesterday on Yahoo News (and on Flipboard yesterday on my tablet) that that the Department of Homeland Security issued a report detailing what platform mobile malware targets on your smartphone.
I decided to do a sanity check – how well does the amount of malware targeted at a platform correspond to the number of users using that platform? After all, for years, Microsoft-defenders (including myself) said that the reason malware authors targeted Windows is because it was the most prevalent OS out there and therefore the one that is the most targeted. Switch around the market share and you switch around the amount of malware per platform.
To figure this out, I went to the DHS’s report and got the smartphone distribution, and then compared it to StatCounter’s global distribution of smartphone usage. In StatCounter’s numbers, since the DHS lumps together all others, and the StatCounter has a lot of different phone OS’s, I decided to exclude all others and adjust the numbers for market share accordingly. I did the same thing for malware distribution.
So what do the numbers show?
Taking a look at the above, the number one platform, Android, has the most malware and it is upwardly disproportional to its market share (that is, the amount of malware targeted at it is more than the market share it controls.
Blackberry, Windows Phone and iOS all have much lower malware targeted at it than the amount of market share it has, but iOS has substantially less malware.
Symbian used to be the number one smartphone and you can see that malware targets it (still) disproportionately upward compared to the market share it has.
The DHS states the following about Android:
Android is the world's most widely used mobile operating system (OS) and continues to be a primary target for malware attacks due to its market share and open source architecture.
Industry reporting indicates 44 percent of Android users are still using versions 2.3.3 through 2.3.7-known as Gingerbread-which were released in 2011 and have a number of security vulnerabilities that were fixed in later versions.
The growing use of mobile devices by federal, state, and local authorities makes it more important than ever to keep mobile OS patched and up-to-date.
So basically:
Because Android is the number 1 platform, it is a primary target for malware attacks. This correlates with the claim that because Windows OS was (and still is) the number one platform on the personal computer, it would therefore be the primary target for those types of attacks.
Android’s open source architecture is another reason it is a target. I don’t know whether or not this is true; I don’t have enough experience in malware to assert one way or the other but there are many other experts out there who can validate this claim better than I can (I suspect that there are advantages both ways).
I have seen Internet commenters state that Windows is insecure by design. Once again, I don’t know whether or not Windows’s architecture makes it more prone to vulnerabilities or not as I don’t have the necessary expertise in that area.
However, it does lead to the next and final point.
Just as in Windows and the PC, the key point is that it is ever-the-more important to keep mobile OS patched and up-to-date.