Does this mean that iOS is more or less just as secure/insecure as Android? I’m not much of a security expert but I continue using iOS under the assumption it was ‘safer’ than android
iOS is more of a monoculture compared to Android, so a successful exploit chain against the current version of iOS has the potential to affect quite a few more users.
On the other hand, the article states that Android is more fragmented, so a successful chain of exploits will likely affect fewer users. The article hints that "one-click" Android exploit chains are harder than iOS, and so are worth more at the moment.
It's interesting to me that a one-click compromise is so valuable given the supply-chain vulnerabilities [0] and ongoing "dodgy-app" issues [1]. Google just dropped a boatload of iOS issues, but they also just took care of nearly 200 issues, some long-standing and some critical in severity, within Android themselves [2].
It seems like declaring one as more secure than the other is more a game of hot-potato than anything.
[0] https://krebsonsecurity.com/2019/06/tracing-the-supply-chain... [1] https://nakedsecurity.sophos.com/2012/07/31/almost-every-and... [2] https://www.forbes.com/sites/daveywinder/2019/08/23/android-...
But the userland of Android is mostly memory-safe Java, and the userland of iOS (e.g. iMessage) is mostly memory-unsafe ObjC. The kind of marshalling and memory management exploits described in the p0 posts are very unlikely to happen on the Android side.
iOS is a Mach+XNU kernel written in C, so it's memory unsafe there. The apps are in Swift, so they're memory safe. Safari/Webkit is not written in this language, so it's memory unsafe.
The only real difference in security here is that Apple has had better sandboxing and security (hardware) implementations.
The hardware you are thinking of is mainly used for secure storage and crypto.
(agree otherwise on the refutal of GP, but curious about that point)
More restrictive permissions (and a new model where you don't need a permission but user decides what file to access) were added later but it takes time to get developers to change.
Apple's phones are more homogeneous. Certainly a larger percentage of Apple users have a Secure Enclave than Android users do.