Slashdot Mirror
Proof of Concept PocketPC Virus Created
SpooForBrains writes "The Register has reported that "Ratter" of the virus writing group 29A has created the world's first PocketPC virus as a proof of concept. This one has no payload and is polite enough to ask if it can spread, so the dangers are minimal, but it occurs that the possibility of PocketPC and Symbian virii suddenly makes the concept of bluejacking somewhat more sinister."
Unless there is a flaw on the implementation of the phone can this kind of virus really spreads?
-- tinyhack.com
Anyway Pocket PC viruses are going to be rarer than one for Macs
Reminds of Donut , the .NET virus ... but there hasn't been a real one in the wild yet ?.
bash$ alias kill='chmod -R 0666 /'
Quidquid latine dictum sit, altum videtur
i really cant wait to start seeing viruses for linux maybe then all you zealots will shut the hell up about MS. As Cavio stated "Linux has security issues" and with security issues and an expanded user base you are bound to get viruses running around, sooner or later it will happen, and it wont matter if there is a patch out within 24 hours of a virus release most people won't patch there computers, most of the problems with computers come from there users. But keeping bitching and moaning about MS one day you'll see, because every OS sucks.
Creating a Pocket PC virus is a trivial matter. It uses the PE format, so I'm sure it would be very simple to adapt virii to infect Windows CE files - basically just a recompile of the virus source to XScale / ARM (assumming it is not in x86 ASM).
.NET / C# bytecode.
Windows CE is actually more secure than Windows XP because the majority of the OS is in ROM. Those files are protected at the file system level - it is not even possible to read or copy the files, let along modify them.
After an infection one could always do a hard reset to quickly have a clean device that is at least usable.
Also, the amount of damage that could be inflicted would be moderate because most PDAs are synchronized with a host PC. So the information on the PDA is essentially backed up multiple times a day.
The real concern would be a virus that could propogate over multiple platforms running different processors. This is one reason to be afraid of
Dan East
Better known as 318230.
As usual, The Straight Dope has an exhaustive entry on the issue:
> Windows CE is actually more secure than Windows XP because the majority of the OS
> is in ROM. Those files are protected at the file system level - it is not even
> possible to read or copy the files, let along modify them.
Keeping files in ROM does not inherently constitute a better virus protection.
Of course, altering a ROM file is (usually) impossible. However, any complex
operating system has a lot of options for RAM or FLASH based files to "hook-in",
and RAM and FLASH are certainly not impossible to alter.
A virus that hooks into the startup sequence of a pocket device is as effective
as a hypothetical one that managed to alter the ROM of that device. Sure, a
ROM device might have a "wipe-all" reset button that gets rid of the virus,
but it would get rid of all personalization data as well - files, installed
software, addresses etc.
So, how does that make the ROM device less vulnerable to virus attacks? It
can't be rendered completely unusable. Ok. But all the other threats continue
to exist. You can loose your data, you can spread the virus to other devices,
you could even sync a multiplatform virus to your desktop PC, etc.
Marc
29A in hex = 666 in dec
CRAZY!
Casual Games/Downloads
I accept that but would argue that a Windows system comes "out of the box" poorly configured for security.
Also, take a script on UNIX/Linux and it's permissions are determined purely by the user who ran it, hopefully not root - therefore its effect on the system must be limited.
On Windows, you can disable ActiveX and VB scripts from running, for example, but I do not know of a way of running them safely with limited permissions. (I possibly bow to your greater knowledge of Windows security here.)
Finally, I'd ask you to consider Windows user general mentality anyway. Most home user types are going to be running their systems at home with Admministrator accounts or with themselves set as Administrators for everything they do. On the otherhand, UNIX people do what they can at their own user levels while only resorting to root to do what they need to at that time.
All of these facts illustrate how a virus/trojan program has more (potentially) devastating effects on a Windows system than a UNIX one.
Gentoo Linux - another day, another USE flag.
This is blatant FUD.
It is, but there is an once of truth in it. The default behavior.
By default, Windows Xp Home runs me as admin, and I had remove permissions for it the be secure...
By default, Mandrake runs me as user. I had to learn to change to root.
But I think the best behavior is with OS X (which I don't own). It prompt you with a password windows each time you need admin access. To me the says: 'STOP! think about what you are doing! Are you sure, you know what you are doing?'
Kinda like the way my sister caught Sircam.exe but when the thing poped-up in ZoneAlarm, she got the reflex to click 'No': "I don't know this application, And everything seems to work OK without it, so there...". She was infested all right, but it didn't spread... (and didn't clog her dial-up line). And off, I did have the "AAAHH! VIRUS!" Reaction when I saw the same pop-up on her computer... Now she google for the file when she don't know... I'm soo proud of my sister, growing up before my very eyes *snif*
Education, can go a long way, but if people can't know they have problems, we can't help them... Default install would go even further... If would force so people to think...
Windows isn't the problem, Ignorance is the problem. Education is the solution.
I live in Soviet Canuckistan you insensitive clod!
"We've come to expect decent security on desktops and servers, why not PDAs as well? At least it may make manufacturers think twice before jumping on the MS bandwagon."
Seeing as how niether the PocketPC nor the PalmOS was built from the ground up with the idea of getting on the net right away, I'm not sure why you'd put any more faith in any PDA short of the Zaurus with its Linux based roots. (Yes, I realize you basically stated this in your subject line, but I don't see how you could ignore Palm in this case given their large market.)
I will say this, though: PDA's aren't like computers, at least not today. Your PDA is chained to your computer. It is, for all intents and purposes, a peripheral. You can't, for example, get on the net with either a Palm or a PocketPC and download/install an app. You have to go through the syncing operation. Because of this very nature of these devices, you can rather easily switch to a brand new unit or get back up to speed on one that's been completely reset. (Doubly useful if your PDA is damaged/stolen, which they are far more prone to than virus damage.) In short, virus security is not that high of priority. It is 'a reaason' to be using Linux on your PDA, but it's so low on the totem pole compared to usability that I wouldn't expect a lot of people to give it that serious of thought. Sad? Maybe. Whoopee, download a patch.
I'm not trying to completely poo poo your point. It's valid. I'm just trying to put it in the proper perspective. The lesson I learned from this story isn't that I should ignore the idea of getting a Palm or a PocketPC, but rather that I should turn lock down the Bluetooth feature on whatever PDA I end up getting. The nice thing about BT is that it does have a trust based relationship doohicky going on with it. I know that's true for PocketPC, and I cannot imagine that the Palm or Zaurus wouldn't respect it either. That's just plain good sense whether the OS is secure or not.
"Derp de derp."
PalmOS viruses have already been reported. PalmOS has a larger market share than PocketPC. Can these numbers be used to understand the relative importance of availability versus vulnerability in the incidence of info viruses?
--
make install -not war
A grad student did this at ISU over 2 years ago when the iPaq was new. His virus didn't do anything harmful but it did propogate itself over wireless newtworks and was an interesting demo for the computer engineering ugrads.
Linux also has APIs for use by local users, that probably should not be callable by just anyone on the internet. The recent exploit on Windows Mozilla has reduced my confidence that Linux Mozilla is not exposing internal APIs.
Mozilla is a big complex app, and I'm not sure I trust it anymore. (I sure as hell haven't audited it. Have you?) I'm starting to think I need to either stop using it, or somehow sandbox it.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.