Mobile Fundamentals · Mobile Operating Systems · Lesson 3 of 4

Android vs iOS

Two designs, two security models.

Two designs

Almost every smartphone runs one of two operating systems. iOS is made by Apple and runs only on iPhones. Apple controls the hardware, the software and, in most countries, the only place to get apps, the App Store. Android is an open-source project led by Google. Many companies, including Samsung, Motorola and Google itself, build phones that run their own versions of it.

They also differ on where apps can come from. Android has long let you install apps from outside Google Play, from another store or straight from a website. This is called sideloading, and you allow it source by source with a setting called Install unknown apps.

iOS was closed for most of its history. Since iOS 17.4 in 2024, the EU's Digital Markets Act has let people in the EU install apps from alternative marketplaces. Apple still runs a basic security check, called notarization, on those apps.

That freedom carries risk. Google says it finds over 50 times more malware in apps sideloaded from the internet than in apps on Google Play. It has announced that app developers will need to verify their identity, starting in a few countries, and says sideloading will stay possible.

The app package

An Android app is distributed as an APK, short for Android Package. Under the hood an APK is a ZIP archive, so an ordinary unzip tool can open one. Inside you'll find:

• AndroidManifest.xml, which lists the app's name, its main parts and the permissions it asks for, stored in a compact binary form
• classes.dex, the app's compiled code (big apps have several of these files)
• res/ and resources.arsc, the images, layouts and text
• lib/, native code for specific processors, if the app has any
• the developer's digital signature, which lets the phone detect if anyone has changed the app

Apps from Google Play often arrive as a main APK plus a few smaller split APKs tailored to your phone. Google Play builds them from a package the developer uploads, called an Android App Bundle. They're still APKs.

Security researchers and malware analysts take APKs apart to see what an app really does, and you'll do the same in the Android App Security track. iPhone apps use a different package format, called IPA.