Mobile Operating Systems

Android and iOS compared

Two operating systems run almost every smartphone and tablet in the world. Both are full operating systems with a kernel, processes, memory management and file systems, but they are built around a touchscreen, a battery and constant network access, and they isolate apps from each other much more strictly than a desktop operating system does. Each app runs in its own sandbox: it can see its own files, and nothing else without permission.

Android is Google's mobile operating system. It is built on a modified Linux kernel, and its core is published as open source (the Android Open Source Project, AOSP). Manufacturers such as Samsung, Motorola, Xiaomi and Google itself adapt it to their phones. Most phones sold outside China also include Google's own, proprietary layer: the Google Play Store, Google Play services and Google's apps.

iOS is Apple's operating system for the iPhone. It shares its foundations with macOS and is closed source. Since 2019, the iPad runs iPadOS, a variant of iOS with features for the larger screen such as windows side by side and better keyboard and mouse support. For support purposes, what applies to iOS nearly always applies to iPadOS too.

Apps, app stores and permissions

App stores and app review

An app store is the platform's official channel for finding, installing and updating apps. For iOS that is Apple's App Store; for Android it is mainly Google Play, with stores from manufacturers such as the Samsung Galaxy Store alongside. The store matters for security more than for convenience:

• Review: apps are checked, automatically and in part by people, before they are published. Apple's review is known to be strict; Google relies more on automated scanning. Review catches much malware, but not all of it.
• Identity: every app is signed by a registered developer, so a later update can only come from the same developer.
• Updates and removal: the store keeps apps updated and can pull a malicious app from sale. On Android, Google Play Protect also scans installed apps.

App permissions

A sandboxed app cannot read your contacts, use the camera or know your location unless you grant it a permission. Both platforms use runtime permissions: the app asks at the moment it first needs something ("Allow Maps to use your location?"), and you can answer with finer choices than yes or no:

• Only while using the app, instead of always (the difference matters most for location).
• Only this time, so the app has to ask again next time.
• Approximate location instead of precise, for a weather app that only needs the city.

Permissions can be reviewed and withdrawn at any time in Settings (on iOS under Privacy & Security; on Android under Privacy or per app under Apps, depending on the manufacturer). Recent Android versions also withdraw permissions from apps that have not been used for months.

The principle behind it is least privilege: an app gets only the access its function needs. A flashlight app that asks for contacts and microphone access is a warning sign. When an app "does not work", a denied permission is also a common cause: a video-call app without camera permission shows a black image, not an error message.

Sideloading, rooting and jailbreaking

Sideloading

Sideloading is installing an app from outside the official app store, for example an Android Package (APK) file downloaded from a website or received in a message. On Android it is possible once the user allows a specific app (a browser, a file manager) to "install unknown apps". On iOS, ordinary users cannot sideload, apart from beta apps through Apple's TestFlight and in-house apps that organizations distribute with an enterprise certificate. In the European Union, since iOS 17.4 (2024), iPhones can also install apps from alternative marketplaces approved under the Digital Markets Act (DMA).

Why sideloading is risky:

• Nobody has reviewed the app. A sideloaded "banking app" or "parcel tracking app" from a text message is a classic way to install malware that reads messages and steals login codes.
• A modified copy of a popular app can look identical to the original.
• Sideloaded apps do not update themselves through the store, so they stay vulnerable.

Organizations therefore block installation from unknown sources on managed devices. Related Android setting: developer options (unlocked by tapping the build number seven times) with USB debugging, which lets a connected computer install apps and read data; it should be off on everyday devices. Rules around sideloading change as regulators and platforms act (Google has announced verification of developers of apps installed outside Play, for example), so check the current state when it matters.

Rooting and jailbreaking

Rooting (Android) means gaining root, full administrator, access to the phone's operating system, which the manufacturer normally keeps for itself. It usually requires unlocking the boot loader, which on most phones erases all data as a protection. Jailbreaking (iOS and iPadOS) removes Apple's restrictions by exploiting a security vulnerability, so that apps can run outside the sandbox and software can be installed from anywhere.

Users do it to customize the device, remove preinstalled apps or run apps the store would not allow. Organizations forbid it because it breaks the security model the whole platform relies on:

• Apps, including malware, can gain root access and read the data of every other app, including work email.
• A jailbreak depends on an unpatched vulnerability, so jailbroken devices are often kept on old, vulnerable versions on purpose; an update usually removes the jailbreak.
• The device can no longer prove that it is in a trustworthy state. Banking apps and MDM detect rooted and jailbroken devices and refuse to work or block access to company data.
• Modifications can also affect warranty and manufacturer support.

Updates

Phones hold email, passwords and authentication apps, and they are always online. Updates matter at least as much as on a computer. The two platforms handle them very differently:

• Android: Google publishes a monthly Android Security Bulletin, but each manufacturer has to integrate the fixes into its own version of Android for each model, and for some phones sold through carriers the carrier tests them as well. So two phones on the same Android version can have very different security patch levels (a date shown under About phone). This fragmentation is why the choice of Android model matters for an organization: some manufacturers now promise updates for up to seven years for recent flagship models, while cheap models may get far fewer. Some core components are also updated separately through Google Play system updates.
• iOS and iPadOS: Apple builds and ships updates for every supported iPhone and iPad itself, on the same day, without carrier involvement. Apple does not publish a fixed support period, but at the time of writing iPhones have typically received new iOS versions for five years or more. Older iOS versions sometimes still receive security fixes, but only the current version is guaranteed to receive all security fixes; older versions get only some of them.

Updates are found under Settings, then General, Software Update (iOS) or Settings, System or Software update (Android, depending on the manufacturer). A device that no longer receives security updates should be replaced or at least kept away from company data; see Updates, Patches and Drivers for why.

Accounts, synchronization and backups

Accounts and synchronization

A phone is tied to a platform account: a Google account on Android, an Apple Account on iOS (called Apple ID until 2024). That account is used for the app store, backups, device location and synchronization. Work data usually comes through a second account, for example a Microsoft 365 work account.

Synchronization keeps the same data on the phone, the computer and the cloud, so a change on one device appears on all of them:

• Email: through the Microsoft 365 or Exchange account (in the Outlook app or the built-in mail app), Gmail, or the Internet Message Access Protocol (IMAP), which keeps mail on the server. The older Post Office Protocol version 3 (POP3) downloads mail to one device and does not sync.
• Contacts and calendars: synced with the Google account, iCloud or Microsoft 365. Each account has its own switches for mail, contacts and calendars, and a missing contact is often simply in an account whose contact sync is off.
• Files and photos: OneDrive, iCloud Drive and iCloud Photos, Google Drive and Google Photos.

Backups

Synchronization is not a backup: a contact deleted on the phone is deleted everywhere. Both platforms therefore also back up the device itself:

• iCloud Backup backs up an iPhone or iPad automatically when it is charging, locked and on Wi-Fi: app data, settings, messages and more. The free iCloud storage is small, so backups often fail with "not enough storage". An iPhone can also be backed up to a computer (the Finder on a Mac, the Apple Devices app or iTunes on Windows); choose an encrypted backup to include saved passwords and health data.
• Android backup stores app data, call history, contacts, settings and text messages in the Google account; photos are handled separately by Google Photos. Exactly what is included depends on the manufacturer and on each app.

A restore happens during the setup of a new or reset phone: sign in with the same account and choose the backup. Backup principles in general are covered in Backup and Recovery.

Mobile device management

An organization with hundreds of phones cannot configure each one by hand, and must be able to protect company data when a phone is lost. Mobile device management (MDM) is software that centrally enrolls, configures and secures phones, tablets and often laptops. Examples are Microsoft Intune, Jamf (for Apple devices) and Google's endpoint management. What it does:

• Enrollment: the device registers with the MDM. Company-owned devices can be enrolled automatically on first start-up, through Apple Business Manager (Automated Device Enrollment) or Android zero-touch enrollment, so the user cannot skip or remove the management.
• Policies: require a screen lock and encryption, set a minimum operating system (OS) version, configure Wi-Fi, virtual private network (VPN) and email accounts, disable the camera in secure areas, block unknown app sources.
• App management: install required apps, remove or block others, and control what managed apps may do with data, for example preventing copying from work email into a personal app.
• Compliance and conditional access: a device that breaks a rule (too old, no screen lock, rooted) is marked non-compliant and loses access to company email and files until it is fixed.
• Remote actions: locate, lock, and remote wipe a lost or stolen device, either completely (factory reset) or only the company data.

The compliance check is simple logic applied to what each device reports. A simplified version, with example minimum versions:

MIN_VERSION = {"Android": (15,), "iOS": (26, 0)}

devices = [
    {"name": "iPhone-Anna", "os": "iOS", "version": "26.0.1", "passcode": True, "rooted": False},
    {"name": "Pixel-Bram", "os": "Android", "version": "16", "passcode": True, "rooted": False},
    {"name": "Galaxy-Chen", "os": "Android", "version": "14", "passcode": True, "rooted": False},
    {"name": "iPad-Sales", "os": "iOS", "version": "18.6", "passcode": False, "rooted": False},
    {"name": "Moto-Dana", "os": "Android", "version": "15", "passcode": True, "rooted": True},
]


def version_tuple(text):
    return tuple(int(part) for part in text.split("."))


def problems(device):
    found = []
    if version_tuple(device["version"]) < MIN_VERSION[device["os"]]:
        found.append("OS too old")
    if not device["passcode"]:
        found.append("no screen lock")
    if device["rooted"]:
        found.append("rooted or jailbroken")
    return found


blocked = 0
for device in devices:
    found = problems(device)
    if found:
        blocked += 1
        print(f"{device['name']:<12} NOT compliant: {', '.join(found)}")
    else:
        print(f"{device['name']:<12} compliant")
print(f"{blocked} of {len(devices)} devices lose access to company email")

iPhone-Anna  compliant
Pixel-Bram   compliant
Galaxy-Chen  NOT compliant: OS too old
iPad-Sales   NOT compliant: OS too old, no screen lock
Moto-Dana    NOT compliant: rooted or jailbroken
3 of 5 devices lose access to company email

Versions are compared as tuples of numbers, not as text: as text, "9" would come after "15". How MDM finds out whether a device is rooted is the platform's job; the MDM only acts on the answer.

BYOD and corporate-owned devices

Bring your own device (BYOD) means employees use their personal phone for work. It saves the organization buying phones, and users carry only one, but it raises a question: how much control may an employer have over a private phone? The answer is to manage only the work part:

• On Android, a work profile (part of Android Enterprise) creates a separate, encrypted container for work apps and data, marked with a briefcase icon. IT manages the profile and can remove it, but cannot see personal apps, photos or messages.
• On iOS and iPadOS, User Enrollment (in its current, account-driven form) keeps managed apps and data in a separate storage area tied to a work account. IT cannot wipe the whole device or see personal data.

Corporate-owned devices are fully managed instead: IT controls the whole device, can restrict settings and can wipe it completely. Apple calls such devices supervised; Android calls them fully managed. A middle form, corporate-owned but personally enabled (COPE), allows some personal use with a work profile on a company phone.

Common mobile support issues

Many of these problems start after an update or a password change, so ask what changed. The battery itself is covered in Laptops and Mobile Devices.