1

Comparing common smartphones running updated versions of Android or iOS to common desktop/laptops running updated versions of Windows or Linux:

Are smartphones inherently less secure? I get the impression that prime targets like politicians, journalists or business people are getting their phones hacked more often than their PCs, but this could just be just my impression and could also be due to the fact that they use smartphones more often than PCs.

I understand they might have a bigger attack surface, SMSs, apps like Whatsapp, ... .

Could a smartphone (maybe running without a SIM card, connecting just through WLANs) be equally safe as a laptop running Windows or Linux?

Is it safer to communicate through MS Teams, Signal running from a PC than the same app from a phone?

Quora Feans
  • 1,861
  • 1
  • 12
  • 20

1 Answers1

1

TL;DR: No, smartphones aren't inherently less secure than PCs. They are just more valuable to target, and generate more media attention.

In fact, smartphones are arguably more secure than PCs. They restrict all applications to an often restrictive sandbox, and require the apps to request permissions for access to basically any resource. Compare this to PCs, where practically all applications have access to essentially everything. (Obligatory XKCD). Additionally, modern smartphones often have much better physical security measures than many PCs.

Smartphones produce much more bang for the buck.

A fully compromised smartphone is will give access to practically all of a target's communications: their phone calls, SMS messages, encrypted text messaging (Signal/WhatsApp/iMessages) and probably their email as well. You will also gain access to a good portion of their web browsing, and their is a very good chance you will gain access to their 2FA as well (Authenticator application or SMS) allowing you to further easily compromise any of their online accounts. Plus, you gain access to any files on their phone (which are often very good kompromat if your goal is to blackmail), their live location and the ability to spy on them covertly through the camera and the microphone.

Compare that to a laptop. You gain access to some of their web browsing, some files (often only professional in nature), and maybe access their camera and microphone some of the time, since the laptop isn't always on and besides you, and a lot of people cover the camera on their laptops.

Smartphones are easier to covertly exploit

A smartphone generally has a larger attack surface directly exposed/accessible from external networks. All you need is a zero-click vulnerability in any of the messaging applications that a target is known to use, and their phone number. This exploit will pass through any firewalls or NATs on the device.

With a PC, it gets more difficult. Generally, a PC will be sitting behind a NAT, so its network stack cannot be attacked directly. And often the only application a target will be using to access the internet is the browser. This means that most exploits will require the victim to click on a link or download and open a file. This can easily raise suspicion, resulting in the exploit getting caught prematurely. A PC is also much more likely to be running security software like Anti-Viruses, again increasing the chances of the exploit getting caught.

Economies of scale

Economies of scale apply much better to smartphones than PCs. Everybody is using the same phone (the vast majority of valuable targets will be using an iPhone) running the same handful of applications. Once found, one zero day exploit chain can be used against a large number of targets.

In contrast, laptops/PCs will be running a larger variety of operating systems with different configurations, and an even larger variety of targetable applications (browsers, mail clients, pdf readers etc), making it much more difficult to develop an exploit that will work against pretty much everyone.

All of these reasons add up to making it much more cost effective for exploit vendors to develop exploits against smartphones. That's not to say PCs are less vulnerable or that exploits targeting them are rare. In fact, based on data from Project Zero, the number of zero days found in the wild in 2021 targeting desktops outnumbers those for smartphones (28 vs 19).

nobody
  • 11,251
  • 1
  • 41
  • 60
  • pretty sure there's more droids out there than iphones... (you've basically got 3 phone OSes and 3 desktop OSes, so kinda the same variety) I'd also add that phone users are more likely to choose convenience over security... (such as using a facebook login for signing in to multiple other sites) They're less likely to want to type as much or investigate link targets... things like that. – pcalkins May 05 '22 at 21:41
  • @pcalkins Yes, there are more droids if you count the general population as well, but I said vast majority of *valuable* targets. Most people worth zero-daying (journalists, politicians, activists etc) use iPhones. But even so, that's 2 major mobile platforms (not sure what third one you refer to) and four desktop OS (Windows, macOS, Linux (with a lot of variants), ChromeOS). – nobody May 06 '22 at 04:25