Security and 2.3

[xiteg79]

Ok, so my company has currently approved the Blackberry and IPhone for use with getting company emails. Now we are wanting to look at approving Android phones but were told with the Android OS 2.2 that it was unsecure and now that 2.3 is out whether or not google has fixed the security issues. I was told that the phones were very easy to hack.

Can someone point me into the correct direction to find this information out?

Thanks

 

[Martimus]

Suggest to your companies I.T. department that they consider email support on Android through the app Touchdown. My company did just this... originally when they announced support through Touchdown I was skeptical. Once I started using it, however, my skepticism went away. Security is built into the app. First thing Touchdown does on my phone is to ask me for a passcode. Touchdown also supports remote wipe through the app.

 

[thedosbox]

I was told that the phones were very easy to hack.

Froyo (2.2) had a number of exploits that were taken advantage of by various malicious apps:

Malware in Android Market highlights Google's vulnerability

Fortunately google removed those from the market:

Google using remote kill switch to swat Android malware apps

Gingerbread has supposedly addressed those particular exploits. However, like all software, various new ones pop up from time to time:

Data Leak Vulnerability In Android Gingerbread - security Blog
DailyTech - How to Protect Android Devices From Newly Discovered Facebook, Calendar Exploit (that article is particularly sensationalist and can be avoided by not using open wifi networks)

Many (but not all) devices can also be "rooted" by use of exploits, thus allowing for full root (admin) access. This is good for users as they can install custom ROM's. Not so good from a infrastructure management POV of course.

However, devices with signed bootloaders are far more difficult to root, so you could consider restricting employees to those devices.

FWIW, my employer supports Android 2.2 and up under Exchange 2007. They do enforce some ActiveSync policies such as requiring a PIN to unlock the phone, encryption and a maximum display timeout of 15 minutes. I can also remote wipe the device via Outlook Web Access.

 

[Yeahha]

If you are worried about people hacking the phone (rooting) then I would suggest using a service like MobileIron.

They have partnered with NitroDesk and created a touchdown client that works with their service. They have root detection so you can prevent those with root access from connecting. As well as OS detection so if you only want devices on 2.3+ having access you can have control over it. They also have device management for iOS, and Blackberry.

As an end user I can vouch for Touchdown, it is a full featured exchange client and works better than the stock client on my device.

 

[takeshi]

Definitely spend some time performing your own due diligence on the information above. IIRC, Touchdown's security features and wipe only apply to Touchdown itself whereas the security features in the stock clients with Exchange support apply to the device -- which may or may not matter to your company.

 

[xiteg79]

I appreciate all of the responses back. I myself work in the Security and Compliance dept for my company and we have several users including myself with Androids. My boss will not approve a 2.2 phone but I was wondering about Gingerbread with Exchange and the security of the phone.