DRIVING
THE MOBILE
ATTACK

 

Financial gain is perhaps the principal driving force behind mobile malicious code, said Joshua Wright, deputy director of training for the SANS Institute, a research and education organization that operates the Internet Storm Center early-warning system. Viruses can let intruders access passwords or corporate data stored on a cell phone. Also, attackers can manipulate a victim’s phone to make calls or send messages, a crime called theft of service.

Users are just beginning to make purchases and conduct financial transactions over mobile devices, particularly in Europe and Japan. Many industry observers expect such activity to increase dramatically during the next few years. Even now, some mobile phone users store their credit card numbers and other financial information in electronic wallet software.

Cell phones are becoming targets largely because of their widespread use, providing millions of potential targets. They also have numerous vulnerabilities. For example, they generally don’t come with antivirus software. In addition, mobile devices are much more connected to the outside world than PCs. “Phones are primarily used to communicate. They are built to make communication as easy as possible,” noted SimWorks’ Davidson. “Phone users want to communicate, and viruses want to be communicated.”

Some hackers may be discouraged from targeting wireless devices because, to reach a large number of victims, they would have to design separate sets of malicious code for each mobile operating system and each processor platform, said Vanja Svajcer, principal virus researcher for SophosLabs, a global network of virus and spam analysis centers overseen by antivirus company Sophos. Cell phones use a variety of processor platforms, including those from ARM, Motorola, and Texas Instruments.

The three dominant mobile-device OSs are Symbian, Palm, and two Windows CE versions: Pocket PC Phone Edition and Smartphone Edition. According to Canalys, an industry analysis research firm, Symbian’s market- leading share rose to 53 percent in 2004 from 38 percent in 2003. Thus, Symbian phones have become malware writers’ favorite target. “If a generic language such as Java is used for creating the malicious code,it could affect devices that support Java,” noted Impivaara.

[Previous Page] [Next Page]