Feeds

Symbian signing is no protection from spyware

One man's Trojan is another's legitimate app

Top three mobile application threats

Spyware for Symbian version 9 is now available signed and verified through the Symbian Signed process, according to anti-malware specialist F-Secure.

Though such applications track what the user is doing and automatically upload that information to a remote server, at least one application is carrying a Symbian Signed qualification; removing warnings that usually pop up when software is installed on a phone.

To gain Symbian Signed status an application must pass a series of tests such as displaying a privacy statement when the application is first launched, and a notification the first time a billable event is triggered. A signed application bypasses the warnings normally displayed when establishing network connections - ideal for spyware, but also useful for dozens of legitimate applications.

In theory, Symbian Signed, or anyone else, could certify applications as benign, but attempts to do so have fallen down in identifying what "benign" actually means. "Nokia OK", the predecessor to Symbian Signed, attempted to vet applications for quality, but ended up being too restrictive. The Symbian-Signed spyware now available would never have passed Nokia OK, but neither did many useful applications.

The problem is that users may perceive the presence of a signature, and certificate, to be proof of an application's benign nature. Indeed, according to the Symbian Signed website: "Symbian Signed builds trust and confidence in third party applications and assists the industry in delivering high quality applications to end-users."

Though quite how much trust is gained by signing spyware applications we don't know.

Digital signatures do serve a useful purpose - they track who wrote and published that application, no more and no less. But knowing that an application was signed by RBackupPRO (as in the case of the Symbian spyware) is little use when even a Google search turns up nothing more than a few articles highlighting this very problem.

A digital signature might tell you who to sue after the event, assuming you become aware that your data has been compromised, but it won't protect you before the damage is done.

It looks as though mobile phone users are just going to have to stick to installing software from known brands, and paying companies such as F-Secure to keep track of malware, rather than realising the potential digital signatures offered. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Virgin Media so, so SORRY for turning spam fire-hose on its punters
Hundreds of emails flood inboxes thanks to gaffe
A black box for your SUITCASE: Now your lost luggage can phone home – quite literally
Breakfast in London, lunch in NYC, and your clothes in Peru
AT&T threatens to pull out of FCC wireless auctions over purchase limits
Company wants ability to buy more spectrum space in auction
Turnbull leaves Australia's broadband blackspots in the dark
New Statement of Expectations to NBN Co offers get-out clauses for blackspot builds
Facebook claims 100 MEEELLION active users in India
Who needs China when you've got the next billion in your sights?
Facebook splats in-app chat, whacks brats into crack yakety-yak app
Jibber-jabbering addicts turfed out just as Zuck warned
Google looks to LTE and Wi-Fi to help it lube YouTube tubes
Bandwidth hogger needs tube embiggenment if it's to succeed
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.