Feeds

Mobile virus epidemics: don't panic

Low risk

  • alert
  • submit to reddit

Eight steps to building an HP BladeSystem

Every time I lose my mobile phone, which happens far too often, I'm given the opportunity to check out the latest and greatest phone technologies available. This is great stuff. They have zoom lenses for pictures and Quicktime videos, they have high resolution color screens, wireless data access for my laptop, they play MP3s, send emails, and even sync my calendar and address book wirelessly with my desktop. With Bluetooth, WAP, and mobile browsers, these are tiny computers with far more power than most people give them credit for.

With computing power comes security weaknesses, viruses and worms. Is no technology sacred from security threats? There is almost no consumer-level technology left where viruses and malicious code has failed to appear (the possible exception being a great source of envy, OS X). Mobile phones are becoming a vector of attack.

At first glance, mobile phones might seem to have all the technology needed for a major virus outbreak in 2005. They have modern CPUs, built-in Bluetooth wireless technology, and data transfer across multiple networks. Many even ship with Java. By some estimates, up to half of these new "smartphones" leave the factory with some version of the Symbian OS, which is gaining in popularity because of endorsements by leaders Nokia, Eriksson, and others. With the worldwide market for mobile phones still growing at a phenomenal 32 per cent in 2004, and with an estimated 1.5 billion people (or 1/4 of the world's population) already owning a mobile phone, virus epidemics that target mobile phones will one day become a reality. But what about in 2005?

The first proof-of-concept mobile phone virus appeared in June 2004 for the Symbian OS, but as proof of concepts tend to be, it proved relatively harmless. Subsequent versions have significantly improved capabilities, but they're still very low risk. Most interestingly, they all use Bluetooth to propagate. Bluetooth is a great technology for connecting small devices that are close to one another, but therein is also its disadvantage: with a few exceptions, the technology has a very limited range. With Macs and PCs, Bluetooth lets you connect your mobile phone, PDA, and laptop to your printer. It lets you sync your calendar and address book, and of course, allows for the transfer of arbitrary data.

Getting infected with a virus via Bluetooth is interesting because it's akin to a human virus, which requires proximity to spread - but it also severely limits how far the virus can go. As newer variants get smarter, however, they'll start to use the phone's GPRS-style data capabilities to spread. After all, they have immediate access to the address book inside your mobile phone.

Who cares?

Why should one care about mobile phone viruses? There is clearly a profit motive, and that's all that is needed to kickstart another dubious industry. From a virus that will dial 1-900 numbers all day long, to the one that automatically buys a hundred ringtones that get added to your phone bill, there is money to be made by the next wave of miscreants. In Asia, telcos have already begun testing e-commerece transactions that are available through your phone. Where there's e-commerce, you can bet there will be viruses and security threats. With such embedded purchase power, I'd hate to think what would happen when I lose that phone.

However, the reality is that the real threat from viruses just doesn't exist today. My prediction is that mobile phones won't experience any major security issues for several years, for the same reasons that we don't see major virus threats in the computer world for any platform other than Windows: there needs to be a critical mass of a given population for the threat to be real. Today there are too many different competing phone technologies, operating systems and architectures for there to be any clear winner.

If the same were true in the computer security world, there would be far fewer viruses than there are today.

I would suggest that the best reason why mobile viruses won't become an issue for some time is the wide array of different phone models, network technologies and embedded operating systems. In short, we have still have choice.

Cellphones have been with us for a long time, but in a way the wireless industry feels like the computer industry was back in the 1980s: many proprietary systems that do interact, to some extent, without any one clear technological winner. With at least 30 mobile virus variants today for the Symbian OS alone, I think many people will be surprised at how easy it will be to carry around malcode clipped to our belt in the years to come.

Copyright © 2004, SecurityFocus logo

Kelly Martin has been working with networks and security for 18 years, from VAX to XML, and is currently the content editor for Symantec's independent online magazine, SecurityFocus.

Related stories

'Metal Gear' Trojan targets Symbian phones
Skulls Trojan keelhauls Symbian phones
Phreakers will rape and pillage your mobile

Securing Web Applications Made Simple and Scalable

More from The Register

next story
Auntie remains MYSTIFIED by that weekend BBC iPlayer and website outage
Still doing 'forensics' on the caching layer – Beeb digi wonk
Apple orders huge MOUNTAIN of 80 MILLION 'Air' iPhone 6s
Bigger, harder trouser bulges foretold for fanbois
GoTenna: How does this 'magic' work?
An ideal product if you believe the Earth is flat
Telstra to KILL 2G network by end of 2016
GSM now stands for Grave-Seeking-Mobile network
Seeking LTE expert to insert small cells into BT customers' places
Is this the first step to a FON-a-like 4G network?
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
BlackBerry: Toss the server, mate... BES is in the CLOUD now
BlackBerry Enterprise Services takes aim at SMEs - but there's a catch
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.