Mobile Malware Demands Multiple Responses

 
 
By Peter Coffee  |  Posted 2004-07-18 Email Print this article Print
 
 
 
 
 
 
 

Collaboration and regulation must finish the job that technology can only begin.

Its great for users, although its traumatic for vendors, when information-based devices evolve from fixed-function appliances into open application platforms. Flexibility always wins in the long run, but an open platform needs to offer its users new applications all the time and also needs to give those users updates to the platform itself at critical times. This requires update mechanisms that are at the same time both simple and secure—a challenging combination. The challenge cant be avoided, as the record clearly shows: Dedicated word processors, for example, didnt know what hit them when general-purpose PCs came along, and pocket calculators have been pretty much eclipsed by the flexibility of Pocket PCs. The same thing has been happening over the past year to mobile communication devices, as that space has become the domain of the smart phone—but with that generality have come hazards as well as opportunities.
When simplicity gets top priority, safety can suffer. For example, Symantecs LiveUpdate facility for products such as Norton AntiVirus was once found vulnerable to hijack, using any of several tricks to make a malware server appear to be resolved from the DNS label of update.symantec.com. That LiveUpdate attack was blocked three years ago by adding a simple cryptographic handshake, but we have to wonder how many other update mechanisms are out there—especially in custom or vertical applications with small numbers of installations—without that kind of protection. Developers must think ahead of the attacker, not let themselves be surprised when attackers take notice of new targets.
The same kind of people who write malicious code aimed at the PC platform have now discovered the mobile device as well. Late last year, a virus for the Symbian mobile platform was said to be a likely prospect by experts including F-Secure research director Mikko Hyppönen; now, that possibility is a reality with the advent of the Bluetooth-propagated Cabir worm. The Pocket PC platform is likewise vulnerable, as now shown by the proof-of-concept WinCE.Dust.A file infector disclosed late last week. I discussed the implications of Cabir with David Staas, director of development for anti-abuse technologies at Openwave Systems Inc. in Redwood City, Calif. Cabir marks an inflection point in the industrys attitude, Staas said, "The mobile carriers went from thinking theyd have to address this someday to, Holy Cow! This is happening today." If even 10 percent of a mobile carriers users have any kind of problem at all, said Staas, that quickly turns into a monumental support cost. Solving the problem, Staas said, depends on three initiatives: Carriers need to collaborate on best practices, through groups like the Messaging Anti-Abuse Working Group; technologies for sender authentication require broad industry development effort and support; and regulatory efforts require international scope.
Without progress on all three fronts, said Staas, the value of the medium is at risk; "We need to work together to win this." Tell me what you expect and/or fear in mobile device malware at peter_coffee@ziffdavis.com. To read more Peter Coffee, subscribe to eWEEK magazine. Check out eWEEK.coms Mobile & Wireless Center at http://wireless.eweek.com for the latest news, reviews and analysis.

Be sure to add our eWEEK.com mobile and wireless news feed to your RSS newsreader or My Yahoo page

 
 
 
 
Peter Coffee is Director of Platform Research at salesforce.com, where he serves as a liaison with the developer community to define the opportunity and clarify developers' technical requirements on the company's evolving Apex Platform. Peter previously spent 18 years with eWEEK (formerly PC Week), the national news magazine of enterprise technology practice, where he reviewed software development tools and methods and wrote regular columns on emerging technologies and professional community issues.Before he began writing full-time in 1989, Peter spent eleven years in technical and management positions at Exxon and The Aerospace Corporation, including management of the latter company's first desktop computing planning team and applied research in applications of artificial intelligence techniques. He holds an engineering degree from MIT and an MBA from Pepperdine University, he has held teaching appointments in computer science, business analytics and information systems management at Pepperdine, UCLA, and Chapman College.
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...
 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
Rocket Fuel