Feeds

Mobile virus epidemics: don't panic

Low risk

  • alert
  • submit to reddit

Next gen security for virtualised datacentres

Every time I lose my mobile phone, which happens far too often, I'm given the opportunity to check out the latest and greatest phone technologies available. This is great stuff. They have zoom lenses for pictures and Quicktime videos, they have high resolution color screens, wireless data access for my laptop, they play MP3s, send emails, and even sync my calendar and address book wirelessly with my desktop. With Bluetooth, WAP, and mobile browsers, these are tiny computers with far more power than most people give them credit for.

With computing power comes security weaknesses, viruses and worms. Is no technology sacred from security threats? There is almost no consumer-level technology left where viruses and malicious code has failed to appear (the possible exception being a great source of envy, OS X). Mobile phones are becoming a vector of attack.

At first glance, mobile phones might seem to have all the technology needed for a major virus outbreak in 2005. They have modern CPUs, built-in Bluetooth wireless technology, and data transfer across multiple networks. Many even ship with Java. By some estimates, up to half of these new "smartphones" leave the factory with some version of the Symbian OS, which is gaining in popularity because of endorsements by leaders Nokia, Eriksson, and others. With the worldwide market for mobile phones still growing at a phenomenal 32 per cent in 2004, and with an estimated 1.5 billion people (or 1/4 of the world's population) already owning a mobile phone, virus epidemics that target mobile phones will one day become a reality. But what about in 2005?

The first proof-of-concept mobile phone virus appeared in June 2004 for the Symbian OS, but as proof of concepts tend to be, it proved relatively harmless. Subsequent versions have significantly improved capabilities, but they're still very low risk. Most interestingly, they all use Bluetooth to propagate. Bluetooth is a great technology for connecting small devices that are close to one another, but therein is also its disadvantage: with a few exceptions, the technology has a very limited range. With Macs and PCs, Bluetooth lets you connect your mobile phone, PDA, and laptop to your printer. It lets you sync your calendar and address book, and of course, allows for the transfer of arbitrary data.

Getting infected with a virus via Bluetooth is interesting because it's akin to a human virus, which requires proximity to spread - but it also severely limits how far the virus can go. As newer variants get smarter, however, they'll start to use the phone's GPRS-style data capabilities to spread. After all, they have immediate access to the address book inside your mobile phone.

Who cares?

Why should one care about mobile phone viruses? There is clearly a profit motive, and that's all that is needed to kickstart another dubious industry. From a virus that will dial 1-900 numbers all day long, to the one that automatically buys a hundred ringtones that get added to your phone bill, there is money to be made by the next wave of miscreants. In Asia, telcos have already begun testing e-commerece transactions that are available through your phone. Where there's e-commerce, you can bet there will be viruses and security threats. With such embedded purchase power, I'd hate to think what would happen when I lose that phone.

However, the reality is that the real threat from viruses just doesn't exist today. My prediction is that mobile phones won't experience any major security issues for several years, for the same reasons that we don't see major virus threats in the computer world for any platform other than Windows: there needs to be a critical mass of a given population for the threat to be real. Today there are too many different competing phone technologies, operating systems and architectures for there to be any clear winner.

If the same were true in the computer security world, there would be far fewer viruses than there are today.

I would suggest that the best reason why mobile viruses won't become an issue for some time is the wide array of different phone models, network technologies and embedded operating systems. In short, we have still have choice.

Cellphones have been with us for a long time, but in a way the wireless industry feels like the computer industry was back in the 1980s: many proprietary systems that do interact, to some extent, without any one clear technological winner. With at least 30 mobile virus variants today for the Symbian OS alone, I think many people will be surprised at how easy it will be to carry around malcode clipped to our belt in the years to come.

Copyright © 2004, SecurityFocus logo

Kelly Martin has been working with networks and security for 18 years, from VAX to XML, and is currently the content editor for Symantec's independent online magazine, SecurityFocus.

Related stories

'Metal Gear' Trojan targets Symbian phones
Skulls Trojan keelhauls Symbian phones
Phreakers will rape and pillage your mobile

Next gen security for virtualised datacentres

More from The Register

next story
6 Obvious Reasons Why Facebook Will Ban This Article (Thank God)
Clampdown on clickbait ... and El Reg is OK with this
So, Apple won't sell cheap kit? Prepare the iOS garden wall WRECKING BALL
It can throw the low cost race if it looks to the cloud
EE fails to apologise for HUGE T-Mobile outage that hit Brits on Friday
Customer: 'Please change your name to occasionally somewhere'
Time Warner Cable customers SQUEAL as US network goes offline
A rude awakening: North Americans greeted with outage drama
Shoot-em-up: Sony Online Entertainment hit by 'large scale DDoS attack'
Games disrupted as firm struggles to control network
We need less U.S. in our WWW – Euro digital chief Steelie Neelie
EC moves to shift status quo at Internet Governance Forum
BT customers face broadband and landline price hikes
Poor punters won't be affected, telecoms giant claims
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?