Mobile phone and PDA malware, such as worms and viruses have been touted as the "next big security threat" by analysts and vendors for at least the past three years. While these predictions haven't come to fruition, attempts to create mobile malware warrant sound handheld security practices now.
Smartphone worms lack smarts
In June 2004, the Cabir worm, which targeted Nokia Series 60 smartphones and propagated via Bluetooth, was released. Cabir got a lot of press, probably due more to the novelty of a non-computing device being attacked via a worm than to the actual magnitude of the threat. Cabir-infected phones scanned the vicinity for other Bluetooth enabled devices and tried to send copies of the worm code to them. In order for the worm to propagate, users needed to answer a prompt asking for permission to receive the message and another one to install the code. This, combined with the short range of Bluetooth connections, limited Cabir's spread. The major effect of Cabir-itis was that it drained phone batteries, again limiting the worm's opportunity to spread.
Virus writers learned from the mistakes of Cabir and later efforts increased the range of infection by using MMS (multimedia messaging service) to send copies of malware over the cellular network as well as social engineering designed to get users to install the software willingly. The CommWarrior worm (also targeting Symbian's OS) masquerades as an antivirus update or battery saving utility and tries both Bluetooth and MMS routes to new victims.
PDA viruses weak
In July 2004, the Dust virus, a proof of concept critter for Microsoft PocketPC systems, was released. Dust was very polite, actually prompting the user for permission to spread and seems to have been more of an academic exercise than a nefarious plot. A month later, a Trojan horse called Brador was released for the Microsoft PDA platform. Since Brador, ther
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
e has not been much activity in the WinCE/PocketPC/Windows Mobile world.
PalmOS-based systems got their first virus back in September of 2000. Phage.963 was a nasty little beast that deleted all applications on the infected system. A few more Trojan horse programs have been released for PalmOS devices, but none of these have evolved into major threats.
Protection from mobile malware
All of the major AV vendors offer antivirus software for phones and PDAs. Personally, I don't currently see this as a good investment. The number of threats is still quite low and the administration burden added by this software is probably much higher than the time it takes to deal with infected devices. If you are going to manage your handhelds, you are better off concentrating on items such as data encryption, password protection and configuration management. These will get you a much higher ROI than AV does currently. However, that's not to say you should let your guard down when it comes to mobile malware.
Here are some best practices to help your users avoid mobile malware and its potential woes:
Will malware attain the threat level on PDAs and phones that it has on computers? You betcha! Mobile malware authors have more room to work as the cost of always-on wireless access drops, and CPU and storage increases. When these become a standard part of the computer in your pocket, antivirus software will become the same kind of must-have add-on to the handheld OS as it has on the desktop.
About the author
Al Berg, CISSP, CISM is the Director of Information Security for Liquidnet (www.liquidnet.com). Liquidnet is the leading electronic venue for institutional block equities trading. According to INC. magazine in 2004, Liquidnet was the fastest growing privately held financial services company in the US and the 4th fastest growing privately held company in the US across all industries.
