Do iOS Devices need Anti-Malware Software?

Apple recently knocked back Kaspersky's request to develop anti-malware software for iOS devices
http://www.theregister.co.uk/2012/05/22/kaspersky_ios_antivirus/

Is this is a wise move on the part of the fruit company? Sure, there is the negative publicity of admitting the possibility of malware - but you can't take the ostrich approach - at some point there WILL be an iOS malware outbreak. The probability that Apple has developed the one true forever impenetrable operating system isn't high. Sure it's theoretically possible, but it's also startlingly improbable.

Because Apple curates it's App Store, it doesn't have the problem that Android devices have with people publishing malware applications. So the OS is relatively secure on that front. But malware infected applications aren't the only way that malicious code propagates.

If you look at Microsoft's update bulletins, you'll often see the phrase "open specially crafted files" when in update bulletins around Office products. Many current exploits rely upon people opening specially crafted files that interact with a particular application.

In the past this wasn't really a problem because it took some effort to actually get files onto an iPad. No memory cards or USB slots meant that you had to come up with a much more cunning plan if you wanted to get files on your Apple tablet or iPhone.

With the rise of DropBox and Skydrive, users are transferring documents back and forth more frequently to their iOS devices. Which brings with it the possibility of exploits that use specially crafted files to leverage vulnerabilities in existing iOS applications. You can already use a specially crafted file to jailbreak an iOS device - and once you've managed to jailbreak an iOS device, all bets are off when it comes to the integrity of the system.

Specially crafted files aren't the only issue. Even when browsers have been sandboxed and secured by more intelligent geeks than you'll find in the average Manhattan project, clever hackers find a way to launch a successful exploit. What's the probability that Safari is completely invulnerable to malicious code hosted on a website? Invulnerability is theoretically possible, but again it's startlingly improbable.

In the long run, if iOS devices continue to gain popularity, they are going to need some form of endpoint protection.  There is no magical and revolutionary model that makes a device unexploitable and it's probably better for Apple to come up with a process by which they can harden iOS against inevitable attacks. Hardening the OS is only part of a security strategy - and endpoint protection is another part. Having someone like Kaspersky and other anti-malware vendors fishing around figuring out how to protect the OS ecosystem can only help minimize the impact of an outbreak when it inevitably occurs.