> You can't get viruses on iOS unless you're jailbroken - Apple's walled garden pretty much guarantees that.

No. Apple can't guarantee their software is secure, so their walled garden doesn't guarantee anything like what you say.

For all practical purposes its true. There has never been a major malware outbreak on iOS, and iOS has never been more secure than it is now.

A while back Apple started pulling anti-virus apps from the app store presumably because they aren't needed: https://9to5mac.com/2015/03/19/apple-app-store-antivirus/. For contrast here is Microsoft's official article on protecting your PC from viruses: https://support.microsoft.com/en-us/help/17228/windows-prote...

In addition, about 80% of iPhones in use are running the latest version of iOS. Apple can patch exploits and have the majority of iPhones secured in a short amount of time. iOS is unique in that respect, and that is just one mitigating factor that makes iOS malware very implausible.

That's just marketing hype mixed with a little bit of goalpost moving. "Has never been more secure than it is now" != secure.

> A while back Apple started pulling anti-virus apps from the app store presumably because they aren't needed.

I think you presume too much. An effective antivirus program cannot run in a sandbox that isolates it from other processes. If Apple pulled 3rd party antivirus apps, I bet it was because they could not both work as advertised and simultaneously obey the sandbox, not because they "aren't needed" (presumably because the platform is "secure").

As for your original statement:

>> You can't get viruses on iOS unless you're jailbroken - Apple's walled garden pretty much guarantees that.

Here's a counterexample: https://www.kaspersky.com/blog/pegasus-spyware/14604/

Pegasus was used by governments to target specific individuals. If you're being targeted by governments I would agree you're out of luck even on iOS.

So, in other words, iOS is insecure and vulnerable to malware.

Governments don't have special hacking powers, they mainly have money and manpower.

It's true, iOS might raise the bar a little bit compared to some other systems, but IMHO it's misleading and dangerous to claim that it's invulnerable.

The point is you're not going to get malware if you open the wrong email or go to the wrong site like you could on Windows. The organizations with enough resources to hack iOS devices aren't interested in sending mass emails to steal bank account details. The average iOS user who keeps their device up to date simply doesn't have to worry about malware and suggesting otherwise is misleading.

> The organizations with enough resources to hack iOS devices aren't interested in sending mass emails to steal bank account details. The average iOS user who keeps their device up to date simply doesn't have to worry about malware and suggesting otherwise is misleading.

Again, no. Here's another counterexample (which is recent and appears to have been active on the App Store for ~1yr):

https://researchcenter.paloaltonetworks.com/2016/03/acedecei...

"These malicious iOS apps provide a connection to a third party app store controlled by the author for user to download iOS apps or games. It encourages users to input their Apple IDs and passwords for more features, and provided these credentials will be uploaded to AceDeceiver’s C2 server after being encrypted."

That's not state actor stuff.

However, I shouldn't have to keep providing counterexamples to convince you of your absurd claims of practical invulnerability. Apple has not made any kind of security quantum leap: no one has. Apple's systems are vulnerable to the same types of flaws, by the same types of attackers, as any other system in wide use. The main difference is that Apple has restricted their platform to the extent they have an easier time implementing security best practices. iOS is still vulnerable to flaws Apple doesn't know about or hasn't patched, and those flaws can be exploited for as long as Apple remains unaware or fails to act. That's not fundamentally different position from Microsoft, Google, or any other similar company.

What you linked is basically an elaborate phishing scheme. The exploit allows the installation of non app store apps, but that doesn't mean the installed apps can escape the sandbox. The worst thing it can do is try to trick the user into entering passwords into the app's fields. As far as malware goes it's pretty benign.

There have been a handful of cases of iOS malware over the years, but no serious exploit has been widespread. For an exhaustive list see here: https://www.theiphonewiki.com/wiki/Malware_for_iOS

The most wide spread malicious apps are generally apps that access private apis but manage to get through Apple's review process and onto the App Store. They can be far reaching but again they can't breach the sandbox which means the absolute worst thing they do is upload your email address to some server or try to trick you into giving away your password. I still stand by my assertion that the average user doesn't need to worry about malware on iOS.

> They can be far reaching but again they can't breach the sandbox

False, they can breach the sandbox. The sandbox is software and it has exploitable flaws until proven otherwise (which hasn't happened).

Look, like I said in another comment: you'd be fine if you restricted yourself to relative comparisons, but for some reason you have to go too far and make absolute statements of security, statements which can't possibly be true. iOS might be more secure than other OSes, but it's still insecure, and it's dangerous and misleading to say that any users don't need to exercise reasonable caution.

While that was an interesting article I didn't see it making any claims of having bypassed the sandbox, but "just" the DRM to allow install of pirated apps. The heavy sandboxing of every app on iOS is fundamentally different from any desktop OS. Sandboxing of desktop apps is still very far from a complete implementation.

> The point is you're not going to get malware if you open the wrong email or go to the wrong site like you could on Windows.

So the point is that you aren't going to get malware on your small, entirely contrained and locked down portable computing device like you are on your larger, general purpose open computing device? Why even bother making that comparison?

OS X has plenty of vulnerabilities.[1] If you want to make a coherent argument, source your claims that modern windows only requires you visit a site or open an email, and we can look to see if Apple has had similar vulnerabilities in equivalent products.

1: https://www.cvedetails.com/vulnerability-list/vendor_id-49/p...

I agree with your statement here but it should be noted that a lot of cyber security is the joke about running away from a bear. I don't have to outrun the bear, I just have to out run you.

Exactly. I wouldn't have a problem if people were saying "iOS is more secure than X" or "You should pick iOS because it's one of the most secure OSes, but you should still be careful." But nooo, the fanboys go too far and spew dangerous, misleading stuff like "it is secure" and "you don't have to be careful" and "it can't get malware."

> If you're being targeted by governments I would agree you're out of luck even on iOS.

Probably true on almost every OS.

There is plenty of iOS malware, its just burred behind a "free" app which appears to be a simplistic game or whatever..

Citation? AFAIK the iOS sandbox has not been broken on un-jailbroken iOS devices, so at worst you're getting a garbage app that doesn't do what it promises.

I've never seen nor heard of any actual malware outbreak from a non-jailbroken app.

Maybe I should have put malware in quotes. I was generally referring more to the privacy invading, battery sucking, ad displaying, etc behaviors of the vast majority of applications. Which per wikipedia (and traditional usage of the term) makes them malware.

Apple/etc seem to be suck in the mindset of the various antivirus products before the advent of adaware/etc. So the products aren't strictly virus/trojans/worms/etc but they definitely fit the definition of malware and the end results are potentially just as bad. I would actually prefer any number of virus's over the some of the shenanigans the facebook app has been accused of.

I know next to nothing about iOS, so: Why can't the (usually public) jailbrake-exploit or another, similar potent (and probably quite expensive) be launched from inside the app? Sure, it has to be hidden to get into the store, but that looks very easy compared to finding the actually jail break. One just has to hide a arbitrary code execution vuln in the code of the app somewhere.

So, every apps seems to be an attack sureface.

If there was a jailbreak available, yes. But there hasn't been a publicly available untethered jailbreak since March of 2016, and there has never been an untethered jailbreak of iOS 10.

The only jailbreak for iOS 10 was semi-teathered and only made public after Apple had patched the vulnerabilities. In order for this to work as malware the user would have to open the malicious app every time their phone restarts. Not only that, every time the they open the app their phone would appear to be out of storage and then promptly crash to the boot screen. It would be a bit of a hard sell.

'Pretty much' guarantees.

I switched to Macs back in 2007. I work in IT, have always been careful to install anti virus software on Windows machines and showed my family how to avoid click bait and dangerous downloads. Even so I frequently used to have to clean malware off my old Windows machines. We do have one windows laptop on Windows 7 which is lightly used and most recently it got infected with a Firefox toolbar extension thing a few years ago that took a week to get rid of completely.

I have never once since 2007 had to deal with a single piece of malware on any of our Macs. I know it exists, Handbrake downloads got infected a while back, but the difference is night and day. In my experience Mac OS is dramatically safer than even a fully up to date Windows machine with top tier virus protection software installed.

Maybe that's changed with recent versions of Windows. Cool. Actually the only thing that drives me potty about Macs is the keychain getting corrupted, drives me potty.

While there is of course no guarantee, most of the shitstained-OS-installations that were (or still are?) so common, with symptoms like non-functional systems, ads popping up, or having 90 toolbars are due to user actions. Sure, there are methods to deliver and elevate malware, but most of the 'problems' people experienced (before widespread banking malware) were practically "cosmetic" and "slowness" and almost always due to users randomly downloading and executing anything in their path.

With iOS, that pattern is a lot harder to abuse, and with enforced sandboxing, side-effects between programs (or, 'apps') are somewhat non-existent.

Most of the things that make non-Windows systems less infected seem to either be due to a better security design, less casual users or a drastically lower market share making it a smaller target with possible less effective organic spreading of malware. (or possibly a combination of the three)

You missed the hedge phrase—"pretty much". Obviously there isn't such a thing as a guarantee for security, but there are counterexamples for most OSs. Do you have one for the current iOS version? I haven't seen someone jailbreak their phone since iOS 5, I think, though people did do it since then.

What's the point of your critique when you can apply it to literally any piece of software? Even SEL4 relies on a correct processor, and yours has flaws.

With all the security hetze and Apple pushing iOS as mainstream OS, I still do not get why this security depends on software and not hardware. Make it impossible for apps to break out of its jail at a hardware level.

Nobody can guarantee their software is secure (secure software doesn't exist), but the cash value of a sandbox escape/jailbreak of iOS on the black market (or probably even through Apple's bug bounty) far exceeds the value that would be generated from some adware or cryptolocker scam all but guarantees that you won't see any widespread malware.

> cash value of a sandbox escape/jailbreak of iOS on the black market...guarantees that you won't see any widespread malware

Why would the black market pay huge sums for a sandbox escape or jailbreak -- unless it's for malware?

If the answer is "for use by intelligence agencies", well that's malware by any reasonable definition.

The same exploits that are used to jailbreak the device can be used for installing malware. There has been remotely exploitable bugs in iOS, for example in WebKit, but luckily there hasn't been people exploiting them. iOS is very safe but not perfect.