Feeds

Mobile virus epidemics: don't panic

Low risk

  • alert
  • submit to reddit

Security for virtualized datacentres

Every time I lose my mobile phone, which happens far too often, I'm given the opportunity to check out the latest and greatest phone technologies available. This is great stuff. They have zoom lenses for pictures and Quicktime videos, they have high resolution color screens, wireless data access for my laptop, they play MP3s, send emails, and even sync my calendar and address book wirelessly with my desktop. With Bluetooth, WAP, and mobile browsers, these are tiny computers with far more power than most people give them credit for.

With computing power comes security weaknesses, viruses and worms. Is no technology sacred from security threats? There is almost no consumer-level technology left where viruses and malicious code has failed to appear (the possible exception being a great source of envy, OS X). Mobile phones are becoming a vector of attack.

At first glance, mobile phones might seem to have all the technology needed for a major virus outbreak in 2005. They have modern CPUs, built-in Bluetooth wireless technology, and data transfer across multiple networks. Many even ship with Java. By some estimates, up to half of these new "smartphones" leave the factory with some version of the Symbian OS, which is gaining in popularity because of endorsements by leaders Nokia, Eriksson, and others. With the worldwide market for mobile phones still growing at a phenomenal 32 per cent in 2004, and with an estimated 1.5 billion people (or 1/4 of the world's population) already owning a mobile phone, virus epidemics that target mobile phones will one day become a reality. But what about in 2005?

The first proof-of-concept mobile phone virus appeared in June 2004 for the Symbian OS, but as proof of concepts tend to be, it proved relatively harmless. Subsequent versions have significantly improved capabilities, but they're still very low risk. Most interestingly, they all use Bluetooth to propagate. Bluetooth is a great technology for connecting small devices that are close to one another, but therein is also its disadvantage: with a few exceptions, the technology has a very limited range. With Macs and PCs, Bluetooth lets you connect your mobile phone, PDA, and laptop to your printer. It lets you sync your calendar and address book, and of course, allows for the transfer of arbitrary data.

Getting infected with a virus via Bluetooth is interesting because it's akin to a human virus, which requires proximity to spread - but it also severely limits how far the virus can go. As newer variants get smarter, however, they'll start to use the phone's GPRS-style data capabilities to spread. After all, they have immediate access to the address book inside your mobile phone.

Who cares?

Why should one care about mobile phone viruses? There is clearly a profit motive, and that's all that is needed to kickstart another dubious industry. From a virus that will dial 1-900 numbers all day long, to the one that automatically buys a hundred ringtones that get added to your phone bill, there is money to be made by the next wave of miscreants. In Asia, telcos have already begun testing e-commerece transactions that are available through your phone. Where there's e-commerce, you can bet there will be viruses and security threats. With such embedded purchase power, I'd hate to think what would happen when I lose that phone.

However, the reality is that the real threat from viruses just doesn't exist today. My prediction is that mobile phones won't experience any major security issues for several years, for the same reasons that we don't see major virus threats in the computer world for any platform other than Windows: there needs to be a critical mass of a given population for the threat to be real. Today there are too many different competing phone technologies, operating systems and architectures for there to be any clear winner.

If the same were true in the computer security world, there would be far fewer viruses than there are today.

I would suggest that the best reason why mobile viruses won't become an issue for some time is the wide array of different phone models, network technologies and embedded operating systems. In short, we have still have choice.

Cellphones have been with us for a long time, but in a way the wireless industry feels like the computer industry was back in the 1980s: many proprietary systems that do interact, to some extent, without any one clear technological winner. With at least 30 mobile virus variants today for the Symbian OS alone, I think many people will be surprised at how easy it will be to carry around malcode clipped to our belt in the years to come.

Copyright © 2004, SecurityFocus logo

Kelly Martin has been working with networks and security for 18 years, from VAX to XML, and is currently the content editor for Symantec's independent online magazine, SecurityFocus.

Related stories

'Metal Gear' Trojan targets Symbian phones
Skulls Trojan keelhauls Symbian phones
Phreakers will rape and pillage your mobile

Protecting against web application threats using SSL

More from The Register

next story
Brit telcos warn Scots that voting Yes could lead to HEFTY bills
BT and Co: Independence vote likely to mean 'increased costs'
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Blockbuster book lays out the first 20 years of the Smartphone Wars
Symbian's David Wood bares all. Not for the faint hearted
Bonking with Apple has POUNDED mobe operators' wallets
... into submission. Weve squeals, ditches payment plans
This flashlight app requires: Your contacts list, identity, access to your camera...
Who us, dodgy? Vast majority of mobile apps fail privacy test
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.