Mobile phone and PDA malware, such as worms and viruses have been touted as the "next big security threat" by analysts and vendors for at least the past three years. While these predictions haven't come to fruition, attempts to create mobile malware warrant sound handheld security practices now.
Smartphone worms lack smarts
In June 2004, the Cabir worm, which targeted Nokia Series 60 smartphones and propagated via Bluetooth, was released. Cabir got a lot of press, probably due more to the novelty of a non-computing device being attacked via a worm than to the actual magnitude of the threat. Cabir-infected phones scanned the vicinity for other Bluetooth enabled devices and tried to send copies of the worm code to them. In order for the worm to propagate, users needed to answer a prompt asking for permission to receive the message and another one to install the code. This, combined with the short range of Bluetooth connections, limited Cabir's spread. The major effect of Cabir-itis was that it drained phone batteries, again limiting the worm's opportunity to spread.
Virus writers learned from the mistakes of Cabir and later efforts increased the range of infection by using MMS (multimedia messaging service) to send copies of malware over the cellular network as well as social engineering designed to get users to install the software willingly. The CommWarrior worm (also targeting Symbian's OS) masquerades as an antivirus update or battery saving utility and tries both Bluetooth and MMS routes to new victims.
PDA viruses weak
In July 2004, the Dust virus, a proof of concept critter for Microsoft PocketPC systems, was released. Dust was very polite, actually prompting the user for permission to spread and seems to have been more of an academic exercise than a nefarious plot. A month later, a Trojan horse called Brador was released for the Microsoft PDA platform. Since Brador, there has not been much activity in the WinCE/PocketPC/Windows Mobile world.
PalmOS-based systems got their first virus back in September of 2000. Phage.963 was a nasty little beast that deleted all applications on the infected system. A few more Trojan horse programs have been released for PalmOS devices, but none of these have evolved into major threats.
Protection from mobile malware
All of the major AV vendors offer antivirus software for phones and PDAs. Personally, I don't currently see this as a good investment. The number of threats is still quite low and the administration burden added by this software is probably much higher than the time it takes to deal with infected devices. If you are going to manage your handhelds, you are better off concentrating on items such as data encryption, password protection and configuration management. These will get you a much higher ROI than AV does currently. However, that's not to say you should let your guard down when it comes to mobile malware.
Here are some best practices to help your users avoid mobile malware and its potential woes:
- Make sure all host systems that your users are syncing their devices to are protected with current antivirus software. In many cases, the desktop system can catch infected applications before they are installed on the mobile device.
- If your users are not using Bluetooth on their phones, PDAs, luxury automobiles or other gadgets, have them disable the feature altogether. In addition to closing the door on some types of malware and unwanted advertising, this will improve battery life on the device.
- If your users simply cannot live without their Bluetooth accessories, make sure that at the very least, their phone/PDA/etc. is not set to be discoverable. While this is not a guarantee that a skilled attacker will not see the device given time and motivation, it will provide some defense against attackers of opportunity. A better practice is to instruct users to activate Bluetooth when they need it and turn it off when not in use.
- While it may seem a bit obvious, we infosec types need to educate our users that, just as they should not click on every attachment sent to their PC e-mail inbox, they should view unsolicited messages and software on PDAs and phones with suspicion. The malware released to date for phones and PDAs requires help from the victim in order to spread. No help, no virus.
- Information kept on phones and PDAs should exist somewhere else as well. Malware is one threat to mobile devices, but there are many others: theft, loss, damage to name a few. No matter which of these results in data loss, having a backup will make recovery easier.
Will malware attain the threat level on PDAs and phones that it has on computers? You betcha! Mobile malware authors have more room to work as the cost of always-on wireless access drops, and CPU and storage increases. When these become a standard part of the computer in your pocket, antivirus software will become the same kind of must-have add-on to the handheld OS as it has on the desktop.
About the author
Al Berg, CISSP, CISM is the Director of Information Security for Liquidnet (www.liquidnet.com). Liquidnet is the leading electronic venue for institutional block equities trading. According to INC. magazine in 2004, Liquidnet was the fastest growing privately held financial services company in the US and the 4th fastest growing privately held company in the US across all industries.
