« Seattle Mobile meeting this week | Main | Day 100 of Mobile Research »
May 11, 2005
Mobile Phone Virususii
There has been a lot of hype lately about virii (viruses) on mobile phones. Symantec has been making a big stink lately about the impending problem. Turns out that it is really
not that big a problem. Which is pretty much what everyone I know in the mobile industry has been saying for a long time.
However...
My friend Mario was in Heathrow yesterday and got a bluetooth message asking him if he would like to install some sort of Heathrow "information for tourists" application. He chose yes, the yes again when it told him that the application was unsigned and "would he still like to install?". A few hours later he starts getting messages from a lot of his friends. Turns out the application had MMS'ed everyone in his contacts list a URL to some website. I didn't get one because I guess there is no MMS interoperability between the old AT&T Wireless network (Cingular Blue) and regular Cingular(Orange).
I really don't consider this a virus because it asked him if he wanted to install it and he chose to even though the application was not certified and he could not authenticate where it came from. It is more of an hostile application. However, a lot of us with smartphones do this a lot because most application vendors aren't signing their applications yet. This is going to have to change in the future. I know that Symbian is already moving towards requiring application signing in their next version of Symbian OS.
The cool thing about this is app is that I suspect one installed, it tries to send itself to other devices within bluetooth range. You could write an application and send it out to anyone who excepted it and that application could continuously propogate itself from handset to handset forever in a place like Heathrow with a lot of people, and probably a lot of smartphone/Symbian users.
This gives me some pretty interesting ideas for some cool (non-hostile) applications.
My mind is a raging torrent flooded with rivulets of thoughts cascading into a waterfall of creative alternatives. -HL
Posted by David Adams at May 11, 2005 10:34 AM
Comments
The venerable Trojan attack MO returns. Hooray.
Posted by: Corey Jewett at May 11, 2005 12:37 PM
Hmm.. that application at Heathrow sounds dodgy.
I read in an article from F-Secure the other day that the current mobile viruses ask you whether you want to install them. Most people click "No" the first two times it pops up, but then click "Yes" on the third time just to try and stop it popping up again.
It needs to have one of those "Don't ask me again" checkboxes :(
Posted by: Chaz at May 11, 2005 04:22 PM
Actually the application installer on the phone will ask you if you are sure you want to install an unsigned app. I've bought a lot of apps though and have never had one that was actually signed with a cert. I always get that box. Of course, I don't install it if I don't know where it has been.
Come to think of it, there was a "show info" application at the CTIA conference that was downloadable from a Bluetooth Kiosk. I am pretty sure it was signed with a certificate.
-David
Posted by: David Adams at May 11, 2005 05:16 PM