Slashdot Mirror
Viruses Find A New Host: Cell Phones
An anonymous reader writes "A NYTimes article (free reg) describes the dangers posed by viruses as 3G and text-messaging become more common, inluding an incident in '01 where numerous phones in Japan began calling 110 (equivalent to 911 in the U.S.). Wired mentions 13M vulnerable phones in Japan alone." (And that was a few years ago.)
After the recent use's of in vehicle mounted cell phones for surveillance I would how long it will be before they (they being anyone legal or not who has a reason to listen) infect your cell phone with snoop and control software.
*chuckle* The next couple of decades are going to be interesting.
Ward
. Silence! Be thankful thy species is unpalatable! .
New York Times Article Registration Free
They are Virii
The internet wasn't designed with security in mind , but these new 3G/4G phones can be.
Isn't this a chance to do things right , rather than repeat the design oversights of the past?
The fact that no one understands you doesn't mean you're an artist.
There should NEVER be an api to mess with the phone numbers and dialing.
keep them seperate from your applications. otherwise you have these silly problems.
--
"I'm not bright. Big words confuse me. But Wanda loves me and that should be enough for you." - Cosmo
Japan should charge the phone company for each fake call to recover costs.
If companies are held financially liable it will force them to do a better job of programming and testing software.
This is inevitable. As people buy more and more stupid gadgets, their lives become geometrically more complicated. Personally, I have a cell phone and I use it for... making telephone calls! No stupid wireless web, messaging, taking pictures, or whatever in the hell people are doing with phones these days. You want the stupid gadgets? You're going to pay for it up front in cash, you're going to pay in time to figure everything out, and you're going to pay in headaches. Rarely are new technologies worth the trouble. A computer is good in it's most basic uses, and a phone is good. All of those stupid ipods/pdas/superphones/etc aren't worth it.
Antivirus software makers did this
New year Resolution: Don't change sig this year
After thinking for a while I guess that phone viruses can be as dangerous as computer viruses, imagine a virus that sends itself to every phone in the address book, calls expensive/international numbers, spams a number till it can't be used any more...
And I think phone viruses are becoming more and more possible through out the advances in phone technology.
The IT section color scheme sucks.
Verizon (the one US provider I am familiar with) already does this, but you have to initiate the install (*861 or something as I recall). However, after the last update, all of a sudden I couldn't get the reception I used to, and I had to punt that phone for Cingular. As I remember, Verizon was having a real problem with text spam.
As cell phones became more powerful (and more like PDA's and computers) this was bound to happen. Unfortunately, with the adoption of GSM in the United States, that means the virus in question can be spread to US phones with the same vulnerability, as 911 is equivalent to 110 and 08 on most GSM carriers.
This is also a small part of the reason that the push was made for Java enabled phones, as there is less of a security risk (albeit still a small one) in running Java apps due to the construction of the language.
There is a somewhat heartening end to this story though. Sprint and other wireless carriers provision signed updates to phone firmware all the time over the air. Most times these updates include communications updates for new versions of software running in the MTSO or in the towers, but this sets a welcome precedent: Security updates can be pushed out to all phones of a particular model when they are first released. This way, a carrier will have no customers lingering months or years behind on updates (a la Windows XP and Windows Update) because the customers do not have to have the presence of mind to update manually, nor do they get to pick and choose what updates they want and what updates they don't.
If a virus can make a phone dial the emergency services, it can presumably also make the phone call the premium-rate phone number the virus writer set up in a foreign country. This could get nasty.
Oh what a virus writers dream. A whole house on the fritz.
30% Troll, 50% Underrated, 10% Interesting
Score:5, Troll
Japanese #1: "My phone has a strange message, what does it say?"
Japanese #2: "I do not know. I don't read ASCII either."
Modern IT works like a natural system.
As soon as there is a host that can be infected, in quantities of relative interest, viruses will evolve that can parasite it.
Mobile phones are safe only so long as they are too stupid to act as carries for self-reproducing code.
A good reason IMHO to spurn "smart" phones.
Ceci n'est pas une signature
Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
DoCoMo blocks about 55 percent of the one billion text messages that reach its servers each day because of suspicious return addresses or attachments. Another 26 percent of those messages are blocked by DoCoMo users who have programmed their handsets to turn back unwanted mail or spam.
Looks like the state of the cell phone is getting close to the dire state of the net in Japan.
And the 3G revolution is now coming our way.
Be afraid. Be very afraid. Especially those with a pay-for-incoming-SMS/e-mails (or pay-for-received-data) scheme.
VBScript is ASCII only, that doesnt stop the virus - the problem is the software on the phone is able to perform (or can be overflowed to produce) actions based on the input recieved.
This problem will get worse if the sandbox around the gaming/user run utilties is weak or unsecure.
It is also something that because devices are already out there would be difficult to prevent or fix. Perhaps requiring the Service provider automatically screening ALL txt messages with known exploits (This is also something the PC ISP's as a whole should do anyway, but thats a different subject).
liqbase
if I buy a cell phone then shouldn't it be just that? A cell phone..?
The 3G phones are pretty much going to become the Windows of the cell phone world - Everyone is going to want one because it's pretty and does lots of things... but at a price.
What kind of signs should we be looking for, like when you tell someone not to open .exe's. I wouldn't even know where to begin.
Also, isn't all of the traffic on cell phones documented? Shouldn't the companies be able to find the culprit fairly easily?
Even worse, your Nutri-matic drink dispenser could start producing beverages that are almost, but not quite, entirely unlike tea.
I ain't evil, I'm just good looking.
...is a phone to make calls!
WTF does this have to do with a virus problem?
Oh, I know it. That lame ass crap I never used on my stupid phone... like games and worse crap they build into phones these days... are the reason.
Maybe if there wouldn't be the *STUPID* need for a fucking OPERATING SYSTEM that can play games and CRAP in your phone you wouldn't have problems with viruses?
As long asd we like to bloat simple things with shit, such stuff keeps happen!
Cell phone viruses? Text-message spam? Never seen on- ... hold on, my phone just beeped ... looks like I've got 53 new text messages...
No, make that 67....
I used to work for one of the manufacturers, they knew several years ago that the same problems which affect PCs would eventually make their way down to the phones they produce as they added features and ended up with general purpose operating systems on the phones. The problem is that fixing phones is far more difficult than a PC.
It looks like they've decided it'll be cheaper not to bother making them secure. Now, if there was a case for secure computing anywhere, it'd be phones.
Government of the people, by corporate executives, for corporate profits.
The article isn't very clear about what is actually behind this problem. Over in the UK we've had text messaging (SMS, whatever you want to call it) for as long as I can remember - I was actually shocked to hear that most American mobile phone companies didn't use it. Anyway...
Point is, I don't think text messages are really the problem here. I've never heard of anything like this happening in text messages. A text message is a text message - a bunch of text. The cleverest thing I've ever seen done with text is being able to send messages that appear in flashing text, and even that only works on Nokia handsets. The only other remotely clever thing you can do with text messages is ASCII art, and we all know how clever that is.
I can imagine it being more of a problem when you get on to the idea of sending more sophisticated stuff, like video or more complex data. Hence I'm not surprised this has already been happening in Japan, as they are miles ahead of everyone on the mobile phone front.
The way I figure it, is there should be no means for a message to do anything remotely clever to your phone. In the same way that a properly set up mail client won't execute any old attachment, but merely present it to the user, a phone should present data or messages and have some means to keep them away from more sensitive parts of the phones software.
The way I see it, mobile phones have got too complicated for their own good. If you want a phone to make calls (remember the days when that was what a phone did?), then buy a phone. If you want to pick up your e-mail, send files to people, or surf the web, buy a PDA for pity's sake. At least the software for PDAs (Windows CE and it's more recent brethren) has been written with a decent knowledge of OS security in mind.
There's been a couple of murderers and rapists and the like in the UK lately who have been caught based on mobile phone records. A murder trial - two young girls, very nasty - that's currently taking place involves the evidence that one of the victim's mobile phones was switched off outside the suspect's house the evening that the girls went missing.
It's all fairly simple stuff at this stage, though it's kinda the stuff we've been seeing in films for years and scoffing at on the basis that it's "so unrealistic". Just the idea of being able to track where a phone signal for a particular phone number is coming from, and tying that to GPS and the like.
There's also the idea that they keep track of what you talk about on the phone - they start recording if you say bomb or president or whatever, that kind of thing.
It is only going to get worse though, as you say. When phones start doing more interesting stuff, there'll only be more for them to watch you do...
Now why am I not surprised this happened?
[rant]
When you take a device that was originally designed to perform ONE function -- in this context, to be a good portable communications tool -- and you start loading it up with all kinds of useless bloat that is completely UNRELATED to being a communications tool, this is exactly the kind of crap you're going to run into.
Contrary to popular belief, not everyone thinks highly of downloadable ring tones, color screens, web access, gaming capability, or text messaging. I know, because I'm one of them. I would be perfectly happy with a simple, rugged, and RELIABLE mobile phone that was exactly that: A mobile phone, perhaps with the voice-activated calling feature, a good-sized speed dial directory, and the ability to snap into a fixed-mount handsfree cradle in the car.
The last thing I need is a ton of "features" that I don't want, don't need, and DON'T want to have to pay extra for just because they're present. Don't even get me started on the insane "Smaller is Better!" craze. It has served only to give us keypads that are so small that Tinkerbell would have problems with them.
[/rant]
Bruce Lane, KC7GR,
Blue Feather Technologies
The internet was designed with reliability in mind , it's meant to route around disasters ( read : nuclear attack ) to keep communication lines up.
If it were designed with security in mind we wouldn't have to bolt - on such additions as SSL or certificates. These are meant to work around the problems that we face now.
Admittedly these wouldn't be such a problem on a purely military network , where every machine has a static IP and a known owner. But that's not the world we live in , is it ?
The fact that no one understands you doesn't mean you're an artist.