Best practices for protecting handhelds from mobile malware

Mobile phone and PDA malware, such as worms and viruses have been touted as the "next big security threat" by analysts and vendors for at least the past three years. While these predictions haven't come to fruition, attempts to create mobile malware warrant sound handheld security practices now.

Smartphone worms lack smarts

In June 2004, the Cabir worm, which targeted Nokia Series 60 smartphones and propagated via Bluetooth, was released. Cabir got a lot of press, probably due more to the novelty of a non-computing device being attacked via a worm than to the actual magnitude of the threat. Cabir-infected phones scanned the vicinity for other Bluetooth enabled devices and trie...

BROWSE BY TAG Threat Monitor,   Wireless Network Security: Setup and Tools,   Handheld and Mobile Device Security Best Practices,   Enterprise Network Security,   Application and Platform Security,   Web Server Threats and Countermeasures,   Web Security Tools and Best Practices,   Web Application and Web 2.0 Threats,   Smartphone and PDA Viruses and Threats,   VIEW ALL TAGS

RELATED CONTENT Threat Monitor Server Message Block Version 2 security in question: Disable or patch? Preparing for future security threats, evolving malware Best practices for (small) botnets Cut down on calls to help desk with cybersecurity awareness training How to detect software tampering How to prevent phishing attacks with social engineering tests An enterprise strategy for Web application security threats How SSL-encrypted Web connections are intercepted How a corporate Twitter policy can combat social network threats Cyberwarfare and the enterprise: Is the threat real? Handheld and Mobile Device Security Best Practices Protecting enterprise networks from new mobile application downloads Screencast: Find rogue wireless access points with Vistumbler Secure your remote users in 2010 Researchers find thousands of flawed embedded devices Best Mobile Data Security Products Should Windows Mobile updates come from Microsoft? MMS messaging spoof hack could have global ramifications How to prevent mobile phone spying Unified communications: Securing a converged infrastructure RIM patches serious BlackBerry Attachment Service flaws Handheld and Mobile Device Security Best Practices Research Web Server Threats and Countermeasures Microsoft doesn't rule out rushed patch for IIS zero-day vulnerability How do passwordless SSH keys represent an enterprise attack vector? Information security book excerpts and reviews Increase in Gumblar backdoors poses FTP credential problems VeriSign extends DDoS attack protection service Microsoft issues IIS FTP advisory, exploit code circulates Panda reports fast-spreading rogueware antivirus fraud rakes in millions Oracle issues quarterly patches, fixes database flaws Latest DDoS attacks extremely unsophisticated, experts say Stolen FTP credentials likely in massive website attacks

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary cache cramming  (SearchSecurity.com) content filtering  (SearchSecurity.com) Web filter  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

d to send copies of the worm code to them. In order for the worm to propagate, users needed to answer a prompt asking for permission to receive the message and another one to install the code. This, combined with the short range of Bluetooth connections, limited Cabir's spread. The major effect of Cabir-itis was that it drained phone batteries, again limiting the worm's opportunity to spread.

Virus writers learned from the mistakes of Cabir and later efforts increased the range of infection by using MMS (multimedia messaging service) to send copies of malware over the cellular network as well as social engineering designed to get users to install the software willingly. The CommWarrior worm (also targeting Symbian's OS) masquerades as an antivirus update or battery saving utility and tries both Bluetooth and MMS routes to new victims.

PDA viruses weak

In July 2004, the Dust virus, a proof of concept critter for Microsoft PocketPC systems, was released. Dust was very polite, actually prompting the user for permission to spread and seems to have been more of an academic exercise than a nefarious plot. A month later, a Trojan horse called Brador was released for the Microsoft PDA platform. Since Brador, there has not been much activity in the WinCE/PocketPC/Windows Mobile world.

PalmOS-based systems got their first virus back in September of 2000. Phage.963 was a nasty little beast that deleted all applications on the infected system. A few more Trojan horse programs have been released for PalmOS devices, but none of these have evolved into major threats.

Protection from mobile malware

All of the major AV vendors offer antivirus software for phones and PDAs. Personally, I don't currently see this as a good investment. The number of threats is still quite low and the administration burden added by this software is probably much higher than the time it takes to deal with infected devices. If you are going to manage your handhelds, you are better off concentrating on items such as data encryption, password protection and configuration management. These will get you a much higher ROI than AV does currently. However, that's not to say you should let your guard down when it comes to mobile malware.

Here are some best practices to help your users avoid mobile malware and its potential woes:

• Make sure all host systems that your users are syncing their devices to are protected with current antivirus software. In many cases, the desktop system can catch infected applications before they are installed on the mobile device.

• If your users are not using Bluetooth on their phones, PDAs, luxury automobiles or other gadgets, have them disable the feature altogether. In addition to closing the door on some types of malware and unwanted advertising, this will improve battery life on the device.

• If your users simply cannot live without their Bluetooth accessories, make sure that at the very least, their phone/PDA/etc. is not set to be discoverable. While this is not a guarantee that a skilled attacker will not see the device given time and motivation, it will provide some defense against attackers of opportunity. A better practice is to instruct users to activate Bluetooth when they need it and turn it off when not in use.

• While it may seem a bit obvious, we infosec types need to educate our users that, just as they should not click on every attachment sent to their PC e-mail inbox, they should view unsolicited messages and software on PDAs and phones with suspicion. The malware released to date for phones and PDAs requires help from the victim in order to spread. No help, no virus.

• Information kept on phones and PDAs should exist somewhere else as well. Malware is one threat to mobile devices, but there are many others: theft, loss, damage to name a few. No matter which of these results in data loss, having a backup will make recovery easier.

Will malware attain the threat level on PDAs and phones that it has on computers? You betcha! Mobile malware authors have more room to work as the cost of always-on wireless access drops, and CPU and storage increases. When these become a standard part of the computer in your pocket, antivirus software will become the same kind of must-have add-on to the handheld OS as it has on the desktop.

About the author
Al Berg, CISSP, CISM is the Director of Information Security for Liquidnet (www.liquidnet.com). Liquidnet is the leading electronic venue for institutional block equities trading. According to INC. magazine in 2004, Liquidnet was the fastest growing privately held financial services company in the US and the 4th fastest growing privately held company in the US across all industries.