Profit Angle

I have read that Android's success is a direct result of Apple's iOS being a walled garden. Let's look at this statement now from two different angles. First, is the walled garden really bad? Second, is this the real reason that Google and Microsoft are actively developing their own hardware?

Is the walled garden really bad?

Apple curates the apps that are allowed into the App Store. This has demonstrably reduced malware compared with Android. Recently, a form of malware, called Gooligan, was found to be present in about 100 apps. It is present in about one million phones in the wild, and increasing at a staggering rate of about 13,000 smartphones per day. I would actually say curation is a plus. So, what is it that people prefer about the Android operating system?

Let's look at what makes Google's Android shine over Apple's iOS.

This article points to three main reasons: Android...

1. can be rooted
2. uses non-proprietary software formats
3. interface can be customized

Rooting

Talk about dubious value. Being able to root Android means (in hacker parlance) the phone can be rootkit'd. In plain English, it means that apps can enter superuser mode and obtain administrative privileges on your smartphone. Once that happens, they can reconfigure your device, redirect its output, and install their own choice of apps. In other words, you are exposed to malware that can steal your passwords, the money in your bank accounts, access your email, snapchat photos, microphone, track your location, keep logs of your text messages, listen in on your phone calls, and essentially every bad thing you can imagine. Malware on Android is a critical problem right now.

Your average consumer should never, ever root their phone. It's only for hackers, spies, and criminals to take advantage of you. What this represents is Google not looking out for you.

Now let's look at how pleasant rooting is on Android. Why should you root your phone? This article spells it out perfectly (while detailing how complicated, dangerous, and potentially undesirable the rooting process can be). The main reason that people want to root their phones is to get rid of the bloatware that's typically installed by the manufacturer (Samsung, for instance). Welcome to the same problem we had in the last millennium with PCs: shovelware. This is how they differentiate their phones from each other in the Android ecosystem -- the same way vendors used to differentiate their PCs in the Wintel ecosystem. But, in comparison, it's a fact that Apple now allows you do delete the pre-installed apps you don't want on iOS 10, without rooting your phone.

Many users want to bypass the complexity of using Terminal to obtain superuser mode on the phone's Linux kernel to change various privileges. Hey: what consumer would want to do that? So they buy rooting software to do it. Can you trust that software? No. In July 2016, rooting software was reported to have installed malware on 10 million Android handsets.

And, by the way, each manufacturer's phone has a different rooting process due to the security bloatware they've installed. Joy.

Non-proprietary software formats

This means that, unlike iOS apps, which are available only through Apple's own App Store, Android apps are available from several sources. The Google Play Store is not the only place you can buy and install Android apps. There are many alternatives, including Amazon Appstore for Android, SlideME, 1Mobile Market, Samsung Galaxy Apps, Mobile9, Opera Mobile Store, etc.

Is this a good thing? It does open up multiple sources for Android apps that run on various smartphones.

But what are the downsides of multiple app stores?

The first problem is fragmentation. Each Android smartphone has a different hardware configuration, which turns out to make the app developer's life hell. Each smartphone has a different screen configuration, for instance. Before buying an app with a specialized purpose, like using the GPS, or a game app with high demands, it's important to decide if that app will run properly on your phone. This is precisely why smartphone manufacturers have been building their own app stores -- not all apps in the Android ecosystem run on every phone.

The second problem is trust. Can you trust the app you download to be free of malware? You would like to know that the App Store you are using is checking for malware. Fundamentally, if they do not have access to the app's code, app stores cannot protect you from malware. What happens is this: you download an app, as it runs, it loads and install malware from some server somewhere. This installs Gooligan.

Nowyou find new apps simply appearing on your phone. This happens because ratings are actually steered by app companies through the use of the Gooligan software. Gooligan installs itself, initially, for the purpose of buying apps it wants you to buy, forging your approval to buy them (and possibly spend money on them) and then rating them highly. These apps can be installed because Gooligan can obtain system privileges. Usually this happens because you enter the admin password for your machine. Perhaps it's to give the app privileges to install some fontware or customization feature. These new apps it installs potentially contain the real malware, because you do not have a choice nor can you control where they come from.

Customizable interface

Really? Can't you customize the interface of an iPhone? You can customize the wallpaper and the lock screen photo. If you want to go further, you can use customization apps like Pimp Your Screen, Call Screen Maker, iCandy Shelves & Skins, Pimp Your Keyboard, and so forth.

On Android, you should ask yourself how much you want customization. After all, it might come with malware.

Oh, cost!

One of the main reasons that people prefer Android is the cost of the phone. Which really has nothing to do with Android. Actually, cost is normalizing because deals with carriers are being made that pay for the phone up front, in exchange for locking you into the carrier for two years (usually). But this applies to all phones now. So, cost is not as much a reason as it used to be. But the plain fact is that, without a carrier deal, Apple's iPhones do cost more.

Why Google and Microsoft are developing their own hardware

Second, is that even the reason that Google and Microsoft are developing their own hardware? No, it isn't. The real reason is profit envy. The price of software has been dropping quickly since the App Store was created. This means it's harder for software-only companies to keep operating margins high. Think Microsoft, who has gone to subscription software to guarantee upgrade revenues, amidst unpopular OS upgrades, like Vista. The profitable niche, mobile devices, must look pretty good to them. Should they merely license OS to hardware manufacturers, like Windows? Will that work? No. Google gives Android away for free: upgrades don't cost anything. So nobody will buy Windows Phone if it costs money. Also, hardware and software both need to be upgraded.

The real reason is that, given that software is becoming essentially free, to make the profit you must make your own hardware. Also to make the hardware work best, you must develop custom software. In fact, the best features require both hardware and software to make them work.

This tight vertical integration is why Apple reaps well over 90% of the profits in the smartphone industry year after year. They sell their own hardware. That, and their profit margin is about 40%.

Value proposition

So, why are people willing to pay a premium price for iPhones?

As always, the price is paid based on the value perceived. The value of better user experience on iOS, easier installs, significantly better privacy and security, and great design is huge. It leads to unprecedented user satisfaction ratings and loyalty. People pay for this, and enjoy the rewards.

Apple devices, on the whole, are more up to date than Android devices. Here is a chart of Android OS versions as of September 13, 2016 and their share on smartphones. It clearly shows the latest version, Marshmallow, at 18.7% installs. And on iOS? As of November 27, 2016, 63% of iOS devices have upgraded to iOS10, 29% are running iOS 9, and 8% are running earlier versions. Get the latest stats on Apple's App Store page.

Clearly Apple's customer base upgrades significantly faster.

General comparison

Consider this article on iPhone vs. Android as a near-complete analysis of the subject.

Hackers, Part 3

There is no shortage of money at banks, usually. That's why criminals are motivated to rob them. But the act of robbing a bank is considerably less risky if you don't actually have to go there. Enter the hacker.

Money, It's a Hit

In previous installments of the Hackers posts we talked about the motivations of hackers. In the case, the motive is money. What drives computer programmers to steal money? Probably bad people with money that want more of it. Yet, a lot of them are overseas and I can't simply ask them, much less even identify them. I can speculate that some are state-supported, looking for handles on the US and other economies to exploit. Or they are criminal organizations that keep their own stable of indentured hackers in the back room, fed with Doritos and Mountain Dew. Or they are simply businesses that do things in shady ways, by contracting hackers to attack their competitors.

Either way, they typically employ a zero-day exploit and a chain of other buffer-overrun bugs to gain superuser access to a machine running Windows XP. At that point, they install a rootkit in the machine so they can gain superuser access at any point down the line. The machine becomes a bot.

Perhaps the most interesting and disconcerting fact is that there exist entities that sell and update rootkit programs. They need updating as Microsoft issues patches to the known exploits. But Microsoft's task is like trying to put your finger in the bottom of the boat when there are hundreds of holes. Ot thousands.

So there is a market, I expect, of zero-day exploits. These are bugs in software that make a system crash. And allow the hacker to upload code. That code might be part of a buffer overrun - the contents written into a buffer that's just too small to hold what's written. Since all machines are Von Neumann machines, this means that you can execute data just like you can execute code. Data and program are interchangeable. This is why the linker can exist, and dynamic linking of libraries can occur.

And it's also why it's possible to upload malware through websites.

Let's take a case in point: Microsoft has been fighting a war of attrition against the Zeus botnet. But, why do they call it the Zeus botnet?

First, a bunch of machines under control of one master hacker is called a botnet, a network of bots. Each machine can be activated by its master to do their bidding. With many machines under the hacker's control, operations like DDoS attacks can be run with greater effectiveness. Or they can use the botnet for sending ridiculous amount of spam emails advertising for fake Viagra. The botnets also give a certain degree of anonymity to their masters as well, because they are only, after all, operating by proxy.

It is apparent that a group of professional attackers maintains the Zeus code, which is code to help penetrate systems. How can such a group exist? They run their shop somewhere in Eastern Europe, away from the reach of the FBI and other law enforcement groups. I really wish that whatever country they are in would have the guts to shut them down. I'm not even sure Interpol has a presence there.

And maybe there is the question as to whether the construction of a tool to penetrate systems is even illegal at all, in and of itself. Still, selling the tool and supporting the tool seems like it is aiding in the commission of a crime.

Yes, the Zeus code costs money also. They charge between $700 and $15,000 US for their code and also for support, which includes updates to current zero-day exploits and also probably tech support via some anonymized IRC chat.

The presence of Zeus means that it's much easier for state-supported hacking and business-supported hacking to exist. These institutional hackers simply buy Zeus and then rent servers to make botnets.

And this is Microsoft's war of attrition: to take down the server farms (otherwise operating legally and used for housing websites and e-commerce operation, and possibly unaware that they house botnets) that have been converted into botnets. Some 13 million computers are used in this way. And this has resulted in the theft of about $100 million since 2007, that we know about.

Business as Usual

Another real problem is the rampant increase in hacking for the purposes of gaining a business advantage.

A really fascinating and discouraging piece of news showed up today. News Corporation, run by Rupert Murdoch, has been accused of another hacking scandal. This time it was purportedly hiring hackers to crack rival ITV network's smart card encryption scheme, and posting it online so most of ITV's customers could simply avoid paying them.

This put ITV out of business, which was just fine for News Corporation's Sky TV service, which likely picked up the customers.

News Corporation was found guilty of hacking one smart card for the DISH Network. And fined a piddling sum. But what actually happens is that they can post the hack (anonymously) and ruin their competitors.

Pretty sneaky, massively illegal, and very immoral.

The tiny fine was a classic Pyrrhic victory for the DISH Network.

4 teh Lulz

It is interesting to see a return of the splinter group LulzSec, so soon after Sabu, LulzSec's leader, was deftly converted to a mole and then turned on LulzSec itself. This had the useful effect of decreasing the hacker world's trust in itself.

Now, an enterprising hacker with the handle lalalalala has penetrated MilitarySingles.com and posted on pastebin all the information about the 171,000 dating servicemen (and women). As part of a new group. And they are calling themselves LulzSec Reborn.

Reborn, presumably, from the ashes of the FBI sting on the group.

This is the trending problem: that technology can change much faster than law enforcement. Tech is the fastest changing thing on the planet. So its a wonder that the FBI, Interpol, and MI-5 can barely keep up with it: they don't always have the tools they need to be effective. Why?

The real problem is that laws can't keep up with technology.