Feeds

Symbian signing is no protection from spyware

One man's Trojan is another's legitimate app

5 things you didn’t know about cloud backup

Spyware for Symbian version 9 is now available signed and verified through the Symbian Signed process, according to anti-malware specialist F-Secure.

Though such applications track what the user is doing and automatically upload that information to a remote server, at least one application is carrying a Symbian Signed qualification; removing warnings that usually pop up when software is installed on a phone.

To gain Symbian Signed status an application must pass a series of tests such as displaying a privacy statement when the application is first launched, and a notification the first time a billable event is triggered. A signed application bypasses the warnings normally displayed when establishing network connections - ideal for spyware, but also useful for dozens of legitimate applications.

In theory, Symbian Signed, or anyone else, could certify applications as benign, but attempts to do so have fallen down in identifying what "benign" actually means. "Nokia OK", the predecessor to Symbian Signed, attempted to vet applications for quality, but ended up being too restrictive. The Symbian-Signed spyware now available would never have passed Nokia OK, but neither did many useful applications.

The problem is that users may perceive the presence of a signature, and certificate, to be proof of an application's benign nature. Indeed, according to the Symbian Signed website: "Symbian Signed builds trust and confidence in third party applications and assists the industry in delivering high quality applications to end-users."

Though quite how much trust is gained by signing spyware applications we don't know.

Digital signatures do serve a useful purpose - they track who wrote and published that application, no more and no less. But knowing that an application was signed by RBackupPRO (as in the case of the Symbian spyware) is little use when even a Google search turns up nothing more than a few articles highlighting this very problem.

A digital signature might tell you who to sue after the event, assuming you become aware that your data has been compromised, but it won't protect you before the damage is done.

It looks as though mobile phone users are just going to have to stick to installing software from known brands, and paying companies such as F-Secure to keep track of malware, rather than realising the potential digital signatures offered. ®

The essential guide to IT transformation

More from The Register

next story
6 Obvious Reasons Why Facebook Will Ban This Article (Thank God)
Clampdown on clickbait ... and El Reg is OK with this
So, Apple won't sell cheap kit? Prepare the iOS garden wall WRECKING BALL
It can throw the low cost race if it looks to the cloud
Time Warner Cable customers SQUEAL as US network goes offline
A rude awakening: North Americans greeted with outage drama
We need less U.S. in our WWW – Euro digital chief Steelie Neelie
EC moves to shift status quo at Internet Governance Forum
Google has spaffed more cash on lobbying this year than Big Cable
Don't worry, it'll be cheaper when they use drones
EE fails to apologise for HUGE T-Mobile outage that hit Brits on Friday
Customer: 'Please change your name to occasionally somewhere'
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?