WALTHAM, Mass. – Bit9, the market leader in advanced threat protection and server security software, today published a new report highlighting the most vulnerable popular smartphones in use today. The devices on the list pose the most serious security and privacy risk to consumers and corporations. In the Bit9 research report, Android phones own the list, accounting for every single spot, 1-12, in the “Dirty Dozen” list of most vulnerable mobile devices; with the Samsung Galaxy Mini taking the top spot, and the HTC Desire and the Sony Ericsson Xperia X10 rounding out the top three.
Fifty six percent of Android phones in the marketplace today are running out-of-date and insecure versions of the Android operating system software. The study found that smartphone manufacturers such as Samsung, HTC, Motorola and LG often launch new phones with outdated software out of the box, and they are slow to upgrade these phones to the latest and most secure versions of Android. In some cases, the phones are not updated at all, as the manufacturers shift their focus to newer models, leaving existing customers stranded with insecure software.
“Smartphones are the new laptop and represent the fastest emerging threat vector,” said Harry Sverdlove, CTO of Bit9. “In our bring-your-own-device work culture, people are using their smartphones for both personal and business use, and attacks on these devices are on the rise. This dynamic is changing the way corporations think about protecting their confidential data and intellectual property. This is the new security frontier.”
The “Dirty Dozen” + 1 List includes:
1. Samsung Galaxy Mini
2. HTC Desire
3. Sony Ericsson Xperia X10
4. Sanyo Zio
5. HTC Wildfire
6. Samsung Epic 4G
7. LG Optimus S
8. Samsung Galaxy S
9. Motorola Droid X
10. LG Optimus One
11. Motorola Droid 2
12. HTC Evo 4G
Coming in at number 13, as an honorary mention, is the Apple iPhone 4 and older models. The criterion for the list was based on the smartphones with the highest market share that were running out-of-date and insecure software and had the slowest update cycles. An in-depth look at the research and methodology can be found online at, http://www.bit9.com/orphan-android .
The trend of prioritizing form and functionality over security in the mobile space has serious ramifications for both consumers and corporations. Mobile phone users are only using their devices as traditional phones about three percent of the time — illustrating that these devices are essentially the next generation of portable computers. Today, smartphones contain personal and confidential business information, and both consumers and companies need to be confident that their data is secure. The majority of smartphones worldwide are running the Android operating system. The open nature of the platform has enabled both innovation and creativity in the mobile space. However, the distribution model adopted by phone manufacturers and their carriers has created a chaotic and insecure environment where it can take several months for important updates to be distributed, if at all. At the heart of the issue, providing software updates for Android phones is currently the responsibility of the individual hardware vendors along with their different carriers.
This would be akin to buying a PC from Dell and relying on Dell to coordinate with your home Internet provider, instead of Microsoft, to update your Windows software. With so many PC makers and Internet providers, the result would be a complete fragmentation of the market, with different computers having different versions of Windows depending on where they purchased the PC and where they live. That is exactly what has occurred within the Android smartphone market. In many cases, the only recourse a consumer has, if they want the latest and most secure software, is to purchase a new phone.
