Original URL: http://www.theregister.co.uk/2007/05/23/symbian_signed_spyware/

Symbian signing is no protection from spyware

One man's Trojan is another's legitimate app

By Bill Ray

Posted in Mobile, 23rd May 2007 10:46 GMT

Spyware for Symbian version 9 is now available signed and verified through the Symbian Signed process, according to anti-malware specialist F-Secure.

Though such applications track what the user is doing and automatically upload that information to a remote server, at least one application is carrying a Symbian Signed qualification; removing warnings that usually pop up when software is installed on a phone.

To gain Symbian Signed status an application must pass a series of tests such as displaying a privacy statement when the application is first launched, and a notification the first time a billable event is triggered. A signed application bypasses the warnings normally displayed when establishing network connections - ideal for spyware, but also useful for dozens of legitimate applications.

In theory, Symbian Signed, or anyone else, could certify applications as benign, but attempts to do so have fallen down in identifying what "benign" actually means. "Nokia OK", the predecessor to Symbian Signed, attempted to vet applications for quality, but ended up being too restrictive. The Symbian-Signed spyware now available would never have passed Nokia OK, but neither did many useful applications.

The problem is that users may perceive the presence of a signature, and certificate, to be proof of an application's benign nature. Indeed, according to the Symbian Signed website: "Symbian Signed builds trust and confidence in third party applications and assists the industry in delivering high quality applications to end-users."

Though quite how much trust is gained by signing spyware applications we don't know.

Digital signatures do serve a useful purpose - they track who wrote and published that application, no more and no less. But knowing that an application was signed by RBackupPRO (as in the case of the Symbian spyware) is little use when even a Google search turns up nothing more than a few articles highlighting this very problem.

A digital signature might tell you who to sue after the event, assuming you become aware that your data has been compromised, but it won't protect you before the damage is done.

It looks as though mobile phone users are just going to have to stick to installing software from known brands, and paying companies such as F-Secure to keep track of malware, rather than realising the potential digital signatures offered. ®