Feeds

Symbian signing is no protection from spyware

One man's Trojan is another's legitimate app

Beginner's guide to SSL certificates

Spyware for Symbian version 9 is now available signed and verified through the Symbian Signed process, according to anti-malware specialist F-Secure.

Though such applications track what the user is doing and automatically upload that information to a remote server, at least one application is carrying a Symbian Signed qualification; removing warnings that usually pop up when software is installed on a phone.

To gain Symbian Signed status an application must pass a series of tests such as displaying a privacy statement when the application is first launched, and a notification the first time a billable event is triggered. A signed application bypasses the warnings normally displayed when establishing network connections - ideal for spyware, but also useful for dozens of legitimate applications.

In theory, Symbian Signed, or anyone else, could certify applications as benign, but attempts to do so have fallen down in identifying what "benign" actually means. "Nokia OK", the predecessor to Symbian Signed, attempted to vet applications for quality, but ended up being too restrictive. The Symbian-Signed spyware now available would never have passed Nokia OK, but neither did many useful applications.

The problem is that users may perceive the presence of a signature, and certificate, to be proof of an application's benign nature. Indeed, according to the Symbian Signed website: "Symbian Signed builds trust and confidence in third party applications and assists the industry in delivering high quality applications to end-users."

Though quite how much trust is gained by signing spyware applications we don't know.

Digital signatures do serve a useful purpose - they track who wrote and published that application, no more and no less. But knowing that an application was signed by RBackupPRO (as in the case of the Symbian spyware) is little use when even a Google search turns up nothing more than a few articles highlighting this very problem.

A digital signature might tell you who to sue after the event, assuming you become aware that your data has been compromised, but it won't protect you before the damage is done.

It looks as though mobile phone users are just going to have to stick to installing software from known brands, and paying companies such as F-Secure to keep track of malware, rather than realising the potential digital signatures offered. ®

Remote control for virtualized desktops

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.