Mabir.A Virus Targets Symbian Phones

adennis writes "Exploiting bluetooth and weaknesses in the OS, the Mabir.A virus, like its predecessor, targets the version of the Symbian operating system running on Nokia Series 60 handsets. Since Symbian is the dominant smartphone OS, found on phones made by Motorola, Siemens, Sony Ericsson Panasonic and Nokia, this virus could have great impact. Will mobile OS companies, like desktop OS makers, have to start an automatic update system, or will the OS creators have to start making their software secure?"

Comments

Same thing?

[soniCron88]

Will mobile OS companies, like desktop OS makers, have to start an automatic update system, or will the OS creators have to start making their software secure?

Wouldn't an automatic update system serve to make the software more secure?

Re:Same thing?

[0x461FAB0BD7D2]

It depends. If the malware authors get their hands on the patches before the vast majority of users do, and manage to figure out what was patched, you would theoretically see an upsurge in the number of exploits, assuming that the vulnerability which was patched was exploitable.

With the slow move towards 3G services, it is a given that exploits will rise, and malware will spread faster.

I, for one, will stick with 2.xG services and phones, because all I really want is a phone.

Re:Same thing?

[badfish99]

No. It means that the software company doesn't have to put so much effort into security, because they can go back and fix problems afterwards with an update.
So they get into a cycle of virus .. patch .. new virus .. new patch ... and many people have viruses all the time. Look at Windows for an example of this.
Of course you need an update system, because you can't guarantee to find every possible security hole before you issue your code, but it's no substitute for good quality code.

Re:Same thing?

[tarmithius]

Will the mobile phone companies charge for these updates like they charge for everything else?

Re:Same thing?

[ManikSurtani]

Yep, pretty much, except that I believe the author meant that s/ware should be written with security in mind from the outset.

On a different note, what I'd loathe to see (but may be inevitable) are goddamn antivirus programs for phones. Imagine those things updating their virus dbs, etc. every time you switch on your phone...

Re:Same thing?

[Anonymous Coward]

Who cares! With the source code of shadow warrior released you can watch wong wash wong on your symbian in no time!!

you have a new friend.. sticky bomb...

Re:Same thing?

[corevps]

I think you have to be careful with the update as if its inthe firmware it could easily delete the users settings knowing how much fun I've had with phone

Re:Same thing?

[Total_Wimp]

The implication is that, if you go to a lot of time and effort, you strip naked at midnight and dance in the moonlight while chanting the secret name of the creator, that you'll somehow manage to make an OS that's "secure" and you'll never need to patch it again.

Many people seam to believe in this "secure" OS that never fails under any cirumstances, even if you hit the spinning hard drives with a hammer and unplug the power cord. They know it's out there so they proclaim anything that needs patching as "unsecure" and move on, with disgust, to the next candidate.

I never know quite what to believe, myself. But sometimes, on warm, summer nights when the moon is full, you might catch a glimpse of me... dancing naked in the moonlight. (You may scream and wake up now)

TW

Re:Same thing?

[ValentineMSmith]

Let's look at Microsoft's history with Win2K and WinXP and then re-ask that question, shall we?

Re:Same thing?

[ThJ]

Isn't it possible to design an operating system using some very strict and controllable principles? Maybe even design a compiler/language that enforces them? Has anybody done something like this already?

Re:Same thing?

[caluml]

Wouldn't an automatic update system serve to make the software more secure?

As long as it's the phone company that pays for the updates. GPRS is about £1 per MB in the UK - it can be as high as £4 though.

Re:Same thing?

[Cat_Byte]

Wouldn't an automatic update system serve to make the software more secure?

From TFA...this is a bluetooth virus. This is no different than all of the wireless routers broadcasting ssid with no encryption and the default admin password still on there. The only update that would save people would be one that forces you to change the password from 1234 if you have bluetooth enabled and are broadcasting your ID.

Re:Same thing?

[Total_Wimp]

Yes, it is possible. But once your code base grown past the very simplest of functions it becomes very, very difficult.

How difficult? I'm not really sure, to be honest, but I picture a mathmatical equation with as many variables as the code itself.

I know there is a branch of programming that says programs can be checked mathmatically to "prove" that they will have no bugs, but my understanding is that they've only been able to produce very simple programs relative to your average OS.

TW

Re:Same thing?

[jsveiga]

Yes, it is.

You only have to make really sure that no application, or action, or input, will in any possible case be able to cause any possible imaginable undesirable effect.

The compiler/language itself would have to be 100% secure too, so I wrote it in assembly. Here is the complete operating system; runs in most CPU architectures, and it's quite hardware independent:

HALT

Of course, if you add more functionality to the OS (or to the secure compilers), testing and certification process times grow exponentially.

Re:Same thing?

[DickBreath]

Wouldn't an automatic update system serve to make the software more secure?

Band-aids are a cure for cuts and scrapes.
Insulin injections are a cure for diabetes.
Various drug cocktails are a cure for aids.

Well, these are actually not cures, and prevention is better than a treatment.

Or let's try this one...

Every time your house gets broken into, try installing a new lock somewhere. First on a window. Next time you are robbed, install another lock, say, on a door somewhere. Etc., etc. Don't these security upgrades serve to make your house more secure?

Re:Same thing?

[poot_rootbeer]

Wouldn't an automatic update system serve to make the software more secure?

Not if virus writers managed to use the automatic update system as a vector for malicious code, which I suspect could have a pretty high likelihood of happening.

Re:Same thing?

[Intron]

That would take incredible restraint on the part of programmers. For example, not accepting and running programs sent disguised as text messages. You're asking for the moon, here. Next you'll claim that email programs shouldn't be able to start programs by clicking on an embedded link! Luddite.

Re:Same thing?

[dgatwood]

Exactly. What we're seeing is just the first round. This problem will keep getting worse as long as we keep making our cell phones into computers.

What I think will eventually happen is that the public will start saying 'no' to all this crap. I'm already sick of it. I don't want a phone that can browse the web. I don't want a camera. I don't want a phone that I can use to play games. I want a phone that allows me to reliably make calls and receive calls, with a phone book that I can sync with my computer over bluetooth, period. Unfortunately, in order to get that synchronization, I have to put up with games, spyware, viruses, cameras, and a web browser, none of which I will ever use.

One of these days, companies will realize that a phone should be a phone and a computer should be a computer and a game boy a game boy, and they'll stop trying to make these idiotic all-in-one gadgets that don't work reliably, have terrible UI, and get hacked on a weekly basis.

The popularity of the iPod shuffle is undeniable proof that this is what customers really want. They initially think that they want the latest 'it does everything' toy, but once they realize what a nightmare those devices are, they flee en masse to something that is simple, does one thing, and does it well. That's the direction electronics are going to take over the next decade or so, IMHO---maybe not to the degree of the shuffle, but definitely towards reduced use of these multifunction devices.

The Quakers pretty much had it right. Simplicity is a virtue. Paper pocket notes don't get wiped when their battery runs down.

Re:Same thing?

[ElGanzoLoco]

Ah, but the phone operators would probably be too happy to charge you in some fashion to download the antivirus updates. Too tempting to resist :)

Re:Same thing?

[ManikSurtani]

And that, in a sense, is what is the most upsetting.

Forget functionality or general benefit to the user - profit, not excellence, is what drives things.

Let's just hope phone OS manufacturers take heed of the state of desktop OSs (pronounced Windows) today and start taking steps to secure their OSs from the outset.

Re:Same thing?

[ElGanzoLoco]

Forget functionality or general benefit to the user - profit, not excellence, is what drives things.

As much as I hate to say this...: Welcome to the real world!

Re:Same thing?

[Anonymous Coward]

i'm happy with my automaticly updating F-Secure Mobile Anti-Virus.

Re:Same thing?

[aziraphale]

Hmmm... I was puzzled by the phrasing of this question, too. What is the poster trying to get at?

If Symbian/Nokia make System 60 more secure, then that's all very well for phones released after they improve their security, but for phones running older, less secure versions of the platform, it's not really much use. So, presumably, if they do improve the security of System 60, they'll need some way to push out those security enhancements to existing System 60 phones. In other words, the only possible logical approach would be to do both.

So what was the poster trying to imply? That they could add an automatic update system to the OS, and that that would obviate the need for them to make the software more secure? Then what would the automatic update software have to do? How would it improve security?

Or that they can simply make the operating system more secure but only need to release the new version of the OS on newer phones, throwing anyone with an older handset to the wolves whenever a vulnerability is discovered?

Curious logic, to be sure...

virus

[theseeria]

again?....whats the point of viruses in the first place.. evil teens with no life

Re:virus

[Anonymous Coward]

Teens being paid hundreds of thousands of dollars to write code that can take remote control of zombie machines for any nefarious purposes.

evil teens with no life? more like rich kids with an easy income source.

Re:virus

[rpozz]

You get a whole article in places like slashdot devoted to your virus, and if you're lucky, a mention on the news. It's anonymous fame for people with nothing better to do.

Re:virus

[DrSkwid]

Ever heard of premium rate numbers and premium rate text message services ?

Re:virus

[Anonymous Coward]

Let's do away with evil teens.

Re:virus

[rob_squared]

I think you're believeing these viruses are for the wrong target. Because most teens with a life don't give a shit about their phone beyond it having mp3s and a camera. The people with symbian OS are either (a) rich or (b) nerds. The virus writers are jealous nerds who are too poor to afford one.

Remember when viruses were cool?

[Dancin_Santa]

There was a time when a virus could install itself just be latching onto a 3.5" disk boot sector and infect tons of machines without anyone having the slightest clue as to its existence.

Nowadays, viruses are so pussified that they need to ask the machine owner to install them. How sad.

Re:Remember when viruses were cool?

[0x461FAB0BD7D2]

I wonder if this is a result of viruses being "pussified" or as a result of improved security for the platforms.

It's a good thing viruses aren't that powerful anymore. It'd be nice to see viruses having EULAs.

Re:Remember when viruses were cool?

[Anonymous Coward]

So true.

Most things today that are considered viruses are not. It is like me writing a program to format your hard drive but then calling it "Supper Happy Fun Game.exe".

It is a given that more then 1 person woudl have their drive formatted and Super Happy Fun Game woudl be called a virus.

Also, remember when they actually did cool stuff to your box (well as cool as a virus can be)

Remember Stoned. That was a real virus.

Re:Remember when viruses were cool?

[Trejkaz]

A click-through EULA on a virus might actually be a good idea. It could shift all blame for any damage to the user, that way, so any attempt to sue the creator would surely fail. ;-)

Re:Remember when viruses were cool?

[badger.foo]

There was a time when a virus could install itself just be latching onto a 3.5"

You had 3.5" floppies?

5 1/4"-floppies (1.2M) were the norm, and 8" ones weren't entirely dead yet either. Back then.

infect tons of machines without anyone having the slightest clue as to its existence.

Technically they possibly could pass unnoticed, but most of the viruses back then would do something to attract attention. Like displaying a low-res graphic, hiding the cursor, or trying to delete files or zap hard disks. Virus coders were generally attention-seekers too.

Re:Remember when viruses were cool?

[Anonymous Coward]

I spent my workstudy time in college working in the largest computer lab on campus. This was the equivalent of working is a computer brothel. I got to see most of the viruses that were out at the time. One of my favorites was one hooked the keyboard interrupt and randomly switched the character the user typed.

It was funny as hell. I had many students furious as they went to spell check their papers only to see them riddles with errors.

I think the worst I did was write one that hooked into the IBM PS2 mouse driver and rebooted the machine if you moved the mouse too fast. I never got the self replicating down to well though so random abort retry fail errors were common.

Re:Remember when viruses were cool?

[Anonymous Coward]

I'm still hoping for a North American release of the Tamagotchi Plus. Spreading a Tamagotchi plague via its IR port might be cool, and the only way to stop a plague of Tamagotchis. For great justice!

Re:Remember when viruses were cool?

[Ilgaz]

For people that doesn't get what you talk about, here is my favorite DOS.

http://www.f-secure.com/v-descs/goldbug.shtml

Respect, really :)

You should be glad the elite ones like below:
http://www.f-secure.com/v-descs/hybris.shtml

Was killed by their author I suppose.

Re:Remember when viruses were cool?

[maxwell demon]

Well, maybe the true viruses are so advanced that really no one has a clue about their existence (which would be the reason why you don't hear of them), and the "permission to install" viruses are actually a way to detract attention from them ...

Re:Remember when viruses were cool?

[DrSkwid]

*cough* trojan *cough*

Re:Remember when viruses were cool?

[Egregius]

Hybris is pretty neat!

I have this weird fascination with viruses and worms. Perhaps because they represent artifical life in the wild. And of course, they're pretty bleeding-edge when it comes to interesting software techniques. For example the Simile-MetaPHOR virus is pretty '1337'. Combining oligo-, poly- and metamorphism, encryption and entry-point-obscuring in highly advanced ways. It even uses genetic algorithms in a limited way to find a good 'shape' that resists emulation by virus-scanners. Self-updating viruses via newsgroups, hadn't seen those yet though. They usually use some central server that gets taken down quickly.

Creating virusses and worms as thought-experiments can be pretty interesting in it's own right, but as long as viruses only alter their appearance instead of their nature, they remain pretty 'un-intelligent'. A virus that harnesses distributed computing in order to find new exploits through which to spread, THAT would be pretty scary. And highly-nontrivial to write.

Re:Remember when viruses were cool?

[strider44]

There was a time when a virus could install itself just be latching onto a 3.5" disk boot sector and infect tons of machines without anyone having the slightest clue as to its existence.

That brings back horrific memories. I remember my brother tried to install doom off a disk borrowed off his friend. The friend had a virus -> the disk had a virus -> our computer had a virus.

It took us hours to even realise it existed, wondering wtf was happening to our computer. In the end we completely formatted our hard drive, reinstalled dos from 6 floppy disks and then my brother, being the bright spark that he is, reinstalled doom...

Re:Remember when viruses were cool?

[MegaFur]

Can't boot sector viruses still be written? Standardly formatted floppies still have a boot sector.

Isn't the manifold, kludgy bootable CD-ROM suceptable to this sort of thing? Although, I suppose *spreading* the virus to other CD-ROMs would be just a tad complicated. :-)

Re:Remember when viruses were cool?

[Anonymous Coward]

I agree.

I guess my real question is

"Why are trojans called viruses?"

and

"Why blame an OS for being vunerable to trojans?"

Re:Remember when viruses were cool?

[Egregius]

Boot-sector viruses can still be written, but they won't do much on Windows 95+ systems. I believe it is because boot-sectors aren't 'loaded' upon reading, just read. And writes to HD MBR's is dissallowed in Windows (can't install GRUB from Windows 95) I believe.

Nonetheless, contagion viruses don't do much anymore since the internet has replaced the sneaker net.

And infecting cd-roms is rather non-trivial, considering the vast array of burning-software that needs to be tricked into writing a bit of extra info to cd-rom each time you burn some aluminium. ;-)

Then again, Windows XP and Media Player have some nifty cd-rom burning features, don't they? Would it be possible to 'add code' whenever some marks files as 'to burn' in explorer?

Re:Remember when viruses were cool?

[Anonymous Coward]

It's a good thing viruses aren't that powerful anymore. It'd be nice to see viruses having EULAs.

Actually, one such virus already does exist. It's called Internet Explorer.

Re:Remember when viruses were cool?

[Anonymous Coward]

I had many students furious as they went to spell check their papers only to see them riddles with errors.

I hate to be the one to break it to you, but it looks like those days aren't over yet.

Re:Remember when viruses were cool?

[confused.brit]

oh, they are here in the Uk too. Please someone write this virus!!!!

Re:Remember when viruses were cool?

[confused.brit]

It really was Doom then.....

Re:Remember when viruses were cool?

[confused.brit]

Please don't gove em any more ideas....

~Groan~

Re:Remember when viruses were cool?

[Ilgaz]

At Goldbug description "Analysis: Mikko Hypponen, F-Secure"

If one of founders like him or Karpersky personally analyses the virus, be afraid of that virus.

As a general rule, for your collection :)

BTW, F-Prot DOS (its still updated people, use with freedos if you want!) still have a preference: "Virus Collection", for hobbyists :)

Security?

[Morlark]

I'd say they'll be wanting to make these phones secure, and be sharp about it. Fair enough, these phones with sophisticated OSes are fairly new, and you might expect them to get hit by viruses to start with, but now that the first few viruses have struck the phone companies are going to want to get these phones as secure as possible, so that they can't get attacked so easily in future. Obviously, there's going to be a need to continued updates, as viruses continue to develop and evolve, but more basic levels of protection need to be introduced first.

Re:Security?

[brainnolo]

Viruses are going to be a problem on Symbian Phones sooner or later, all the manufacturers can do is to make it impossible to run without user stupidity. But now, smartphones users may not think about these risks, because they do not yet acknowledge they own a PDA that can make phone calls as well, not a phone.

What would be useful is to make the users aware of this problem, but this could harm the sales of this relatively new product (i wouldn't be going to buy it knowing of this risk).

Vulnerability

[Anonymous Coward]

I wonder if the fact that the recent OS X vulnerability still unpatched after more than 2 months with the symbian component of iSync is related to this? would it be possible for an infected mobile phone to use the exploit in the mrouter code on OS X to infect the OS X machine remotely?

Re:Vulnerability

[Anonymous Coward]

If you are referring to the iSync mrouter exploit it was patched within a week after release.

Re:Vulnerability

[Anonymous Coward]

No, it's not. Still vulnerable on a fully up-to-date system.

Ofcourse they have to be secure.

[flubbergust]

Why shouldnt the creators make the system more secure? Its their responsibility to make it more secure. What if you have to dial 112 (911 for people in other parts of the world) and you cant? Phones have to be secure. I can live with my Windows box isnt but damned if my phone isnt secure.

Re:Ofcourse they have to be secure.

[jcostom]

You know, in fairness, that even if you're foolish enough to leave your bluetooth device set to be discoverable, you still have to accept the file being sent to you, unless it's coming from an already trusted device - something you've paired with.

Anyone that gets infected with this gets what they deserve. Hopefully at this point, you wouldn't open a strange file attachment, so why would you accept a strange file on your phone?

Re:Ofcourse they have to be secure.

[hc00jw]

I can live with my Windows box isnt but damned if my phone isnt secure.

Why? Why can you live with your computer being insecure? Why do you accept this? Especially when there are secure alternatives!

Re:Ofcourse they have to be secure.

[0x461FAB0BD7D2]

Perhaps they decided the extra time and effort required to make it that much more secure wasn't worth the wait. Decisions such as these are based more on marketing and business than IT and security.

I'm sure we'd all love to have super-secure devices and software. But that takes time. And competitors whose products are not as secure would steal your market-share. Do you think users are going to wait months to use a product with similar functionality but that is 10% more secure?

Neither did I. It's about the bottomline. Plain and simple.

Re:Ofcourse they have to be secure.

[ceeam]

Because most computers are nothing more than media center + game console. And secure alternatives are only as secure as their "root"s are. And if you can manage a "secure alternative" than there are good bets that you can manage your Windows box secure. And there are far fewer games for "alternatives". Yes, an email + browser pre-set Linux box for grannies is generally (slightly) more secure than the same box running Windows.

Re:Ofcourse they have to be secure.

[peragrin]

Of course the guy who ran to the market early to steal your market share, had to have a major recall in order to restore 3 million phones that were infected with a virus. Now that compnay is on the verge of bankruptcy and your selling phones like hot cakes.

In ANY other industry the security holes of Windows would be considered unsafe, and MSFT would be facing billions of dollars of damage and recalls.

Because Software doesn't really exsist as a physical item, they don't have that problem.

Re:Ofcourse they have to be secure.

[Morlark]

The sad thing is that people do open strange file attatchments. I don't really expect this behavious to significantly change on phones. People who make software, whether for PC or mobile phone just have to account for the fact that users are stupid.

Re:Ofcourse they have to be secure.

[Anonymous Coward]

...so why would you accept a strange file on your phone?

It might be a female toother sending you a promiscuous request ! ;-)

Re:Ofcourse they have to be secure.

[0x461FAB0BD7D2]

Right. In any other industry. But Symbian is in the same industry - software. They, both Symbian and its competitors, don't have to make it that extra bit secure, because they can patch it later on.

People are used to their software having flaws. People are not going to ask Symbian or the phone manufacturers to change their phones because of a virus, just as those same people don't ask Dell or HP to change their PCs for them when they get hit by the latest adware from Golden Palace.

Knowing all that, I, too, would release a marginally insecure product to get marketshare. It's not right, but I can understand.

Re:Ofcourse they have to be secure.

[Anonymous Coward]

i have tons and tons of data stored on ntfs partitions.

o sure i have messed around with fedora(i like that one)
knopix and i tried openbsd(the later one i installed only to become confused and remove it)
none of these gave me direct acces to my files
i'm not about to install a not jet 100% proof hack that can read ntfs files nor am i planning on getting more hdd's so i can transfer everything over ftp.
and i'm sure as hell not going to ntfs to fat
over 700GB of data(read crap but i like my crap).
give me something that can read and edit ntfs
so i can make the trasition without to much hastle over time

thats the main reason why i'm still useing windows
i'm open to sugestions

Re:Ofcourse they have to be secure.

[confused.brit]

999 here ;)

~beat the 20 sec message into pulp~

Re:Ofcourse they have to be secure.

[confused.brit]

Or it could be my mate sending his 'furry' porn like he usually does in the cinema to get people to turn off their phones....

Re:Ofcourse they have to be secure.

[confused.brit]

Suggestion 1: Proofread using preview before you post... I had one hell of a job making out your point....

virus free os

[freddej]

So, I guess this is becoming more and more ordinary, writing secure code is not going to happen, and with new ways in (bluetooth, browsing with the phone, wireless access via phone in the future?) and so on I think we just have to rely on autoupdates for every os with no exception of PAN-devices. Just like we humans have constant amount of bacteria in our mouths we have to get used to having a constant flow of viruses through our computers/phones/pda's etc.

Re:virus free os

[Stevyn]

I'm not too worried about viruses on phones now. However, if I ever see an "Antivirus Fee.....$3.23" on my cell phone bill, my head is going to explode.

Repeat after me...

[jcostom]

I will turn off bluetooth or set my phone's visibility to off.

I will turn off bluetooth or set my phone's visibility to off.

I will turn off bluetooth or set my phone's visibility to off.

There, was that so hard? If for some reason, you refuse to do that, don't accept files from other devices unless you specifically know they're ok. You know, just like you do with your email.

Re:Repeat after me...

[Anonymous Coward]

I have enough trouble finding where I left my phone without turning is visibility off.

Re:Repeat after me...

[DarkHelmet]

Honestly, that shouldn't be an excuse.

Bluetooth is used commonly for things like headsets nowadays, which is particularly useful when driving of all things.

It's kind of like saying that a system is "waiting to be hacked" by having its firewall turned off. A firewall is just one layer of security that's used in order to secure a computer.

Phones are computers nowadays. The phone manufacturers simply cannot use bluetooth being left on as an excuse.

Anyway, I imagine virii like this over the next few years will spark a much greater concern for security within nextgen phones.

Re:Repeat after me...

[badfish99]

So your idea for security is that everyone in the world should strictly follow this rule all the time, with no exceptions, and should never forget it? That isn't going to happen.
What could happen is that the phone manufacturers could make the effort to install a secure operating system. Then I could accept files from other users all the time, without worrying about how much I trusted them to follow such rules. You know, just like I do with my email.

Re:Repeat after me...

[AvitarX]

what about toothing?

And why is Symbian wors than Microsoft's alternative?

I remember when MS said they were doing a phone all the jokes were "Blue Screen LOLOROTFLMAOLOLOL!!!!!" and "Virus OMG LOLOLOLOLOLOLOL!!!!!", but it seems that in the end it is Symbian with the virus troubles.

Re:Repeat after me...

[hgavin]

> I will turn off bluetooth or set my phone's visibility to off.

This version of the worm propagates by MMS.

Re:Repeat after me...

[Zayin]

I will turn off bluetooth or set my phone's visibility to off.

Setting your phone's visibility to off is not enough to stop attacks.

There are already tools out there that find non-discoverable bluetooth devices. A worm might use the same technique.

Re:Repeat after me...

[maxwell demon]

Didn't the name "bluetooth" already imply that it would eventually bite you? :-)

Re:Repeat after me...

[wheany]

The virus does not get installed on the phone without user intervention. The user has to install the virus. How the hell do you protect a computer from people who install programs after they have been told that the program might be harmful?

Re:Repeat after me...

[wheany]

You can accept files from other users just like you can with email. And just like the recent email viruses, you must explicitly run and install the virus.

There is nothing a phone manufacturer can do about that. Well, except not allowing any non-pre-packaged software to be installed.

Re:Repeat after me...

[Anonymous Coward]

There is no vulnerability involved here, so one cannot devise a patch. Hence the thing is hardly a virus - more like self propagating malware that you have to agree to install explicitly.

The malware just searches for BT phones and sends BT object to them - pretty much like any legit software. What do you suggest - digitally sign programs so that signed only would be granted BT access? This shuts the door for small time developers. I think we've been down this road before with ActiveX...

Re:Repeat after me...

[strider44]

It's not quite about Microsoft vs. Symbian to most people here. Most people take the piss out of Microsoft because it's sooo easy to do, but actually have no real grudge against them.

I think looking at this case Microsoft scores really big here. Microsoft don't have a good track record but really there's no excuse for a security hole as bad as this. If you grab input from another computer you secure yourself against it as much as possible, including and especially wireless technology, as you can't verify that the person on the other end is a nice guy.

Perhaps some of the Symbian engineers need to go back to Software Engineering first year and retake some (admittedly boring) but needed classes.

Re:Repeat after me...

[jcostom]

Just like the other one, but it also infects via BT. If you're not in some stranger's phonebook, he can't MMS you.

Re:Repeat after me...

[DM9290]

Phones are computers nowadays. The phone manufacturers simply cannot use bluetooth being left on as an excuse.

You dont need to turn off bluetooth. Turn off "bluetooth visibility".

With bluetooth visibility off, then anyone who wants to bluetooth to your phone must ALREADY KNOW THE BLUETOOTH NAME. That is to say, they must already have had access to your phone.

With bluetooth visibility is off, you can still use wireless headsets or whatever else you like. The only difference is that you will not receive unsolicited communication from others because they cant communicate with your phone without knowing the bluetooth name.

And if you want to leave bluetooth visibility on then:

DONT ACCEPT FILES BEING TRANSMITTED TO YOUR PHONE IF YOU DONT WHO THEY ARE FROM.

And moreover:

DON"T INSTALL PROGRAMS ON YOUR PHONE IF YOU DONT KNOW WHAT THEY ARE.

The problem is not Symbian. The problem is user gullibility, ignorance and naivety.

Bluetooth is OFF by default. If you turn it on, then RTFM!

Not much threat?

[Richie1984]

I had to read quite a way down TFA before I actually came to the information detailing what the virus actually does.

"At this point, mobile viruses are more of an irritant than a serious security...the messages that Mabir sends do not contain any text message, only the info.sis file.

So it seems this virus is more of a proof that they can be spread via phones, which we already knew, rather than an attempt to actually damage or corrupt the OS. Hopefully it'lll persuade manufacturers to work more on their phone security, rather than obvious new features for the user.

Re:Not much threat?

[Ilgaz]

Forget media. While passing by, ask a Nokia or Ericsson,siemens service center if they had some phones completely dead and had to flash over service hardware.

Those companies spend BILLIONS to advertising. No sane reporter will make 2-3 infections news but doesn't change those viruses REALLY exist and believe or not, spreads.

There are people who automatically say "yes" to everything pops up at their phone. I know one myself personally. Not me.

Had 2 cabir requests in 5000 people Prodigy concert myself.

Mabir.A ?

[Anonymous Coward]

Is there a convention in naming viruses? For example this is one is called Mabir and the A is a variant or type classification?

Re:Mabir.A ?

[soniCron88]

A little dated, but:
What's In a Name?

Exploiting Bluetooth?

[gonzo-wireless]

Saying that this virus exploits Bluetooth is similar to saying that a windows virus exploits CAT5. The software running on the phone is vulnerable, not the transmission medium.

Re:Exploiting Bluetooth?

[narcolepticjim]

I think that's a pretty poor analogy. Bluetooth isn't a radio wave, it's a protocol.

Re:Exploiting Bluetooth?

[SenseiLeNoir]

Actually, having had a Symbian Phone (P800) and knowing exactly how things are transfered to/from it. its not even the software in the phone that makes it vulnerable, but more often than not, its the wetware in between the ears of the users

Not a big deal.... yet

[Albinoman]

A lot of people already have to update their roaming info. Why cant this stuff be updated at the same time? Current phones wouldnt be able to, but Im sure cellular providers would rather do that than suffer the wireless version of a DOS attack (you know it will happen).

Re:Not a big deal.... yet

[kyojin the clown]

already has. back in 2000, when ICQ could send SMS in the UK (i dont *think* it can anymore), we used to bang off twenty or thirty to a friends's phone - since SMS capacity in 2000 on the average phone was low (10-15), this would swiftly fill the memory, and then they would queue up in the message centre. delete one, get another one. renders the phone useless until you have churned through deleting the whole lot. we actually used to call it a DDoS

send a couple of hundred off, and you can basically prevent someone from using their phone for the best part of a day. possibly this is why the networks stopped allowing ICQ to send SMS. it was bloody great when used sensibly though, i wish trillian could do it now.

Well, I'm not impressed

[KonijnenBunny]

I own a Nokia 60-series phone and much to my surprise I encountered the above mentioned predecessor (Caribe/Cabir) in the wild. (Yep, my bluetooth's always on)
I received over 20 identical messages by Bluetooth messaging, all containing a single application-installation file: caribe.sis I had to approve the reception of the message first before I could view the contents. As I browsed the message contents, a further warning that it contained an application was issued, and I image the standard "not-signed" warning would as well if I'd try to actually install it.

That's 3 warnings I would have to ignore before the virus is installed. Surely in this day and age anyone's brains would have kicked in and wonder whether it would be a wise idea to install an unknown program sent to you by an anonymous stranger? Mobile-phone virii are all still very proof-of-concept in my book...

Re:Well, I'm not impressed

[Kevok]

That's precisely the reason why I never leave Bluetooth on. I've often sat on a bus and out of curiosity looked for other bluetooth handsets on the same bus, they all usually have the default ID for their phone. Most customers who buy their phones will have never heard of Bluetooth before and so when they see messages like that, they will naturally open them. It doesn't take too long to turn bluetooth on, so unless you're using a Bluetooth headset, it should remain off until needed. Customers should also be notified of threats like this by their network.

Re:Well, I'm not impressed

[rmccann]

It should be off when you turn on your phone. Most people don't change from the default settings. Better to be secure by default than the slight inconvience of turning it on.

Re:Well, I'm not impressed

[Anonymous Coward]

Surely in this day and age anyone's brains would have kicked in and wonder whether it would be a wise idea to install an unknown program sent to you by an anonymous stranger?

Just rename it to crazyfrog.sis then they'll install it.

Re:Well, I'm not impressed

[h3rmanni]

Many of the users who've really been hit by any of the phone Bluetooth worms (there are several) have explained themselves along these lines: "I got a cryptic message on my phone. I didn't understand what it was asking...so I clicked 'No'. When I did that, the message popped up again. So I clicked 'No'. Again. 'No'. Again. Then I tried 'Yes', and the message went away..." It makes sense, kind of.

Re:Well, I'm not impressed

[Ilgaz]

You are a Slashdot user and you know what ".sis" is.

Do not generalize. It would be an excellent world if persons of your type weren't only 2% or less of population.

I speak about people paying $5! for a single midi ringtone!

Re:Well, I'm not impressed

[confused.brit]

Which is how people get hit by spyware/malware and browser hijackers all the time Oh, what i wouldn't give for automatic updates for people....

Re:Well, I'm not impressed

[bcmm]

Leave the basement and you'll find that some non-geeks are stupid. Really stupid.

No

[amling]

Patching mistakes after your customers have suffered for them is a little different than doing it right the first time around.

Elementary measures

[Savage-Rabbit]

Will mobile OS companies, like desktop OS makers, have to start an automatic update system, or will the OS creators have to start making their software secure?"


Not having every single Bluetooth service known to man switched on by default when the phone leaves the factory would be a good start. The first thing I did when I got my new PDA phone was to switch everything off except the BT Headset and File Transfer which I set to Maximum possible security since it wasn't set like that by default. Strictly speaking the FT services should only be activated on a need-to-use basis but I don't carry alot of sensitive information on my PDA phone and what there is I have encrypted on an SD card. That would incidentally be another good idea, if manufacturers were to install some sort of file-vault software as standard. I had to install the file-vault software as an optional software package from the companion CD that came with my phone.

Re:Elementary measures

[springbox]

I completely agree with you, and it would be nice if more manufacturers of most electronic equipment (wireless APs would be another example) started to make their stuff more secure by default. The major problem is that they're trying to give users "ease of use" over "more security," which has already been proven to be an approach that's flawed.

Re:Want a surefire solution?? I have the answer.

[imipak]

Want a surefire solution?? I have the answer. [...] And it ain't pretty. Death penalty for virus writers.

What a great idea. I'm sure this will work just as effectively as the USA executing alleged murderers - brutal as it sounds, it has at least reduced the murder rate to one of the lowest in the world.

Another FUD from F-Secure

[S3D]

This theme is beat to death. So called "virus" require answer "Yes" three times to be installed. The most vocal reporter of these viruses is F-Secure, manufacturer of anti-virus software for symbian phones. Their CEO speaking on one of the previous virus: "somehow, I'm not sure exactly how this virus get installed on my phone" He did't remember answering "Yes" three times ?

Handheld viruses

[springbox]

I'm not familiar with this particular handheld OS, but it would be funny if someone tried to write a virus for the PalmOS, because it largely wouldn't work.

"Please execute this program to destroy your system" is what the approach would have to be and doing a hard reset of all of the memory and hotsyncing it would completely wipe the thing out of the system. This is where volatile memory and a somewhat restrictive setup will benefit the user.

No OS creator cares about security.

[akadruid]

will the OS creators have to start making their software secure?

All commercial operating systems are written to the point where the security is just good enough to sell the product and no further.

When operating systems are tied to the product or the vendor has a monopoly on their market then the point of 'just good enough' is reached long before the end user can regard the product as secure.

I predict: Software security will only become worse as consumor adoption of future devices hostile environments such as the internet increases. Within 10 years, end users will be comfortable with performing routine software maintainence on a myriad of devices they currently consider reliable over the life of the product. This will include: all communications products; vehicles; home automation and security; entertainment systems; electrical white goods and diy tools.

When the dominant multi-purpose operating system can be regarded as usuably secure out of the box for the life time of the product, then I'll reconsider.

Worms

[nmg196]

Why is Slashdot's icon (top right) for the "worms" section a picture of a caterpillar, which is in no way related to a worm?

Re:Worms

[PhilHibbs]

http://dictionary.reference.com/search?q=worm, usage 2.

Re:Worms

[Anonymous Coward]

Well, that definition was very informative.

Re:Worms

[CylanR77]

Because that little green caterpillar is usually called an inchworm.

Re:Worms

[Anonymous Coward]

Well, that definition is wrong. I emailled them and I expect them to remove it shortly.

Re:Worms

[sjames]

Why is Slashdot's icon (top right) for the "worms" section a picture of a caterpillar, which is in no way related to a worm?

While it IS a catapillar, it is called an Inchworm

Make secure

[fozzmeister]

The evil empire (MS) would have done this ages ago (yes they'd still be bugs that would let things thru, but it'd be better) if it wasn't for programs assuming they can write anywhere etc. MS trapped themselves. With phones being so young, and also being a new product every version (the OS dependencies are small), it'd be hard for them to excuse there being security problems.

But auto update would also be needed, no software is perfect.

Re:Want a surefire solution?? I have the answer.

[Anonymous Coward]

You're joking aren't you? The UK has a per-capita murder rate about one quarter that of the US, and many European countries are significantly lower.

Simple answer to Article's question

[phooka.de]

"Will mobile OS companies, like desktop OS makers, have to start an automatic update system, or will the OS creators have to start making their software secure?"

Both. Or maybe... isn't it far better for socializing that you're able to talk about how Windows didn't work and you fixed it than to own a machine / gadget / technology that simply works.?

So maybe the answer truly is Neither.

Re:Another FUD from F-Secure

[tomstdenis]

You're assuming they're not the ones who wrote the virus in the first place...

Simple trick, don't buy phones known for crappy security. Symbian phones have been attacked before...

Though I agree this highly bad virus that requires the users permission to install is hardly a "virus" and more of a darwinism.

tom

Re:Another FUD from F-Secure

[pandrijeczko]

Unfortunately, whenever they make things foolproof, along come the better fools.

Symbian OS will never be secure

[Anonymous Coward]

I'm am an experience commercial software developer on the Symbian platform. I have a strong background in many other platforms and i the context of this message, my anonyminity is important since my company can be sued by Symbian just for a biased negative opinion of Symbian made publicly.

Symbian OS is the most expensive platform to develop on. This means more expensive money and time wise. It takes 3 times as many developers to deliver the same product in twice the time as on comparible platforms (brew, iTron, etc...) as for platforms with real development tools such as Windows Mobile, we use ten developers on Symbian to every one on Windows Mobile to produce a lesser product.

Symbian has limited hardware level debugging support (if any at all), they lack so much as a command prompt to log to.

They lack decent compilers and you're stuck with GCC or ARM Realview (neither are that good, satisfactory at best on ARM).

Documentation is aweful at best.

A simple program requires you to just through hoops, more complex sets the hoops on fire.

The emulator environment emulates nothing and simply tries to implement the Symbian UI APIs on Windows and all system level stuff is just layered on Windows. That's fine if you don't need to do anything at the system level.

The development environment is heavily based on CodeWarrior these days. I find this funny since every other company (Nintendo, Sony, Be, Apple, etc..) where Metrowerks had a good footing, the companies found it more profitable to dump CodeWarrior and do it themselves instead. Symbian is the only company stupid enough to choose to rely on Metrowerks, especially with their pathetic resume.

As for security, the fact that anyone could possibly ship a product based on Symbian is a miracle in itself. As for securing it as well, I think you're just asking too much.

Re:Symbian OS will never be secure

[Anonymous Coward]

"Symbian OS is the most expensive platform to develop on."

You've clearly never developed to OS/390 running Unix System Services or NCR's MP-RAS platform.

Re:Symbian OS will never be secure

[Anonymous Coward]

My company is supposed to start development on Blackberries soon. Why do I feel like it's going to be exactly the same on that platform! :-(

I don't understand why these phone companies have to reinvent the wheel by making their own OSs. Surely it would be easier/cheaper to use/adapt an existing one.

Re:Symbian OS will never be secure

[ecki]

As for securing it as well, I think you're just asking too much.

For somebody who claims to be so experienced, you know surprisingly little. Does the term Platform Security ring a bell?

Re:Symbian OS will never be secure

[Anonymous Coward]

10 odd years of reading /. and it takes this to get me to post...

I've been working with the Symbian OS for some time and the parent smells strongly of BS...

> Symbian has limited hardware level debugging support (if any at all), they lack so much as a command prompt to log to.

There is support for both hardware level debugging and there has been a working command prompt for several versions. I suggest you ask Symbian (nicely) how to access these.

> They lack decent compilers and you're stuck with GCC or ARM Realview (neither are that good, satisfactory at best on ARM).

What's wrong with GCC suddenly? It's bad compared to what? MS Visual Studio? Arm compilers are what you get for ARM chips - still the undisputed leader for the mobile market.

> Documentation is aweful at best.

It is patchy. It's getting better...

> That's fine if you don't need to do anything at the system level.

I've seen a variety of system level debugging on the emulator. Maybe you need some pointers?

> The development environment is heavily based on CodeWarrior these days.

I'm told Symbian has good feedback into Metroworks and gets their CW specifically tailored for them so maybe it's better than their usual product.

> As for security, the fact that anyone could possibly ship a product based on Symbian is a miracle in itself.

Which is obviously why they have something like 80% of the smart mobile market...

> As for securing it as well, I think you're just asking too much.

The next big release is supposed to be all about security.

> as for platforms with real development tools such as Windows Mobile, we use ten developers on Symbian to every one on
> Windows Mobile to produce a lesser product.

So why are Microsoft content to deals with Symbian that hurt their own mobile devision? Even they seem to have given up on their own product...

Re:Symbian OS will never be secure

[Ilgaz]

He is really experienced, seems you aren't.

I live sort of shit for 2 weeks that one of my licensed applications from a very well known, very cool company stopped working at new version. There was nothing, repeat nothing to send a bug report other than digging the applications and write down their versions.

They suggested it. As I call myself advanced user and wanted to help those guys, I asked if there is anything like "crash log" on my 7650 and I can send easily. There is NONE. Look, a daemon system level crashes, nothing logged at user side. Memory constraints? Well, there are 2 games installed by ROM occupying 200+ kb of precious 7650 memory.

Platform security? Thats why I suggest you never used symbian or a newbie. You can't get a security license without paying to Nokia and/or Symbian.

So, whatever you code, even if you provide entire community free of charge, like FExplorer, your installation will ALERT user just like the virus because you couldn't pay to those crooks.

I know it may hit me someday but they really deserved it.

I tried not to give names since there are teenagers here blaming Frisk for distributing fud to sell $10 antivirus. Same guys at one point had full loaded symbian pirate cds and installed like 60 applications to their memory card ignoring all warnings.

Hope Frisk will work with cell phone manufacturers, and stop that blog thing hurting their credibility needlessly.

When we see Nokia/Ericsson recalling their phones to update their firmware, they will hopefully understand the risk of the problem reported.

I just don'T like a company which I used their products for free since '93 (in my dos days) and offering them in somewhat free being flamed by teenagers as crooks.

Re:Symbian OS will never be secure

[ecki]

He is really experienced, seems you aren't.

If you say so... you must know.

Platform security? Thats why I suggest you never used symbian or a newbie

Good one, that made my day :D - trust me, in a Symbian OS experience pissing contest I would win.

You can't get a security license without paying to Nokia and/or Symbian.

So what, we are discussing security on a technical level, not on a "how much does it cost you" level. On the technical level, PlatSec is secure by design. Note that I'm not saying that it is robust against implementation bugs, such as buffer overflows or design errors.

If you can't afford signing, you a) don't get access to system level capabilties such as AllFiles, b) need user consent to user level capabilities and c) probably won't be able to have your application installed on most phones anyway because operators will be very happy to restrict installation to signed apps only.

What is it you want then: no software signing, no security checking and viruses/malware, or signing fees and no viruses/malware?

Re:Symbian OS will never be secure

[Ilgaz]

I just want a better community doesn't speak BS about companies like Frisk which was founded before they born saying they spread FUD.

I am NOT a developer for gods sake, I just see everything is unsigned and great coders have to excuse because of so called software security.

Lets start speaking the FACTS. Symbian, Cellphone , PDA is a piracy hell. 8 or 9 of 10 people uses CRACKED software. They can hardly sell stuff for $8 (yes- EIGHT dollars) to few people respecting their work like me and you suggest them to enable that license/signature whatever making them $12 each?

This will be my last comment on this topic. Have a nice day.

Re:Symbian OS will never be secure

[Late]

>I'm told Symbian has good feedback into Metroworks and gets their CW specifically tailored for them so maybe it's better than their usual product. As far as I know Nokia bought the Symbian OS parts of Metrowerks last year. At least it says so here. I would call that rather complete tailoring. Of course it is a bit worrying for companies using other flavors of Symbian OS than Series 60/80/90 as Nokia will probably focus on those.

Re:Symbian OS will never be secure

[ecki]

Hey, I enjoy a good argument any time :) If applied cleverly, PlatSec is actually a way for small developers to prevent software piracy. You just have to be creative to figure out how mandatory application integrity checking can be used against crackers ;) - I think it will outweigh the cost required for signing.

Re:Symbian OS will never be secure

[evilviper]

I don't understand why these phone companies have to reinvent the wheel by making their own OSs. Surely it would be easier/cheaper to use/adapt an existing one.

Symbian OS is NOT a new OS, it is a VERY old one. Not only is it older than Windows CE and Palm OS, it predates Windows on the DESKTOP PC, having first appeared as a full GUI OS in 1989, and having roots back even further.

Before it was called Symbian, it was called EPOC found on Psion devices, but it's still the same OS.

ahref=http://3lib.ukonline.co.uk/historyofpsion.ht mhttp://3lib.ukonline.co.uk/historyofpsion.htm>

In any case, don't believe the anonymous troll. Symbian is a GREAT platform that really puts all other OSes (for handheld devices) to shame, and it's been doing so for a very long time.

Security in software

[flajann]

Once again we see that security in software design often is an afterthought. I can understand a small software company not having the time or resources to address these issues -- and even then that's questionable. But what are the "big boys'" excuses?

I think it is quite silly and worrisome that PC users have to be so concerned about virii and spyware and have to invest time and effort in dealing with these hassles. Now we've got to have these same annoyances for our cell phones and PDAs? Excuse me?

No one wants to think about security until it's too damned late. Better to deal the issue up front than take a hit later. But will they listen to little ole' me? Nope!

So I sit by the side lines and watch with glee the idiots making the same lame-brain mistakes over and over again, and then have to suffer for it -- or their customers have to suffer for it. Talk about divine comedy. Now that's entertainment!

Re:Want a surefire solution?? I have the answer.

[Anonymous Coward]

Yep...
http://news.bbc.co.uk/1/hi/world/153988.stm

the *.* virus

[Mr_Tulip]

Nowadays, users are so pussified, that if you tell them there's a virus called "*.*", and it's in the windows folder, they will happily check which files are infected - just tell them to type "dir *.*" at a command prompt, and then believe you when you tell them that to remove the virus, all they have to do is type "del *.*"

Re:Another FUD from F-Secure

[Catullus]

Symbian phones hardly have crappy security. They are targeted by "virus" authors because they are the only popular open smartphone OS around.

Incidentally, there is basically no way that an open OS can protect against this sort of thing. If the user has the ability to install applications, the user has the ability to install viruses. There are two obvious ways to stop trojans like this spreading over Bluetooth:

1. Disallow the reception of applications over Bluetooth. But then how would users get legitimate applications from their PCs to their phones?

2. Only allow "signed" applications to use Bluetooth. But then small third-party developers would find it difficult to develop and market their software without it getting "signed" (at probable expense). And what about freeware?

In any case, Symbian are changing their security model to try to combat threats like this one, no matter how based on FUD it is.

Re:Another FUD from F-Secure

[tomstdenis]

I seem to recall stories a few months ago about it...

Eitherway, stupid users can darwin their cell phones. So long as they don't add to the email spam problem I don't care!

BTW [ot] if you want to have a lot of fun with spam, open a yahoo account, post the address in a bunch of usenet forums, turn off spam filtering and wait a couple of weeks.

Then open up your inbox (which will likely have around 1500 spams in it) and sort based on subject.

Seeing 23 "CONGRATUALATIONS" in a row is just hilarious...

Tom

Darwinism

[Anonymous Coward]

Just as the predominant, most accelerated technology growth comes out of human conflict (ie. war), computer security evolves fastest when it is forced to react to real-world situations.

There is no point in asking what their motivation is; heck, I was 16 once too. Plus, nowadays many virus writers are actually commissioned by greater evils, like spam/malware/etc.. comprimised (zombie) machines (of any type) can be misused in a variety of ways..

Re:Another FUD from F-Secure

[Afty0r]

Their CEO speaking on one of the previous virus: "somehow, I'm not sure exactly how this virus get installed on my phone" He did't remember answering "Yes" three times ?

Of course he remembered answering it - well, probably didn't remember actually answering yes, but he remembered the sales and marketing meeting where the Marketing Director told them all about the plan to have the CEOs phone "infected" with a virus of an "unknown" origin - and told them that this would get press releases and make the news because of his very position.

He remembered that all right, and he followed the script when talking to the press.

You insinuate the CEO is slow for not remembering clicking "yes" - I insinuate you are slow for not realising this was fiction, a marketing trick.

All I want is a phone!

[Zemplar]

Am I the only one that misses some of the great cell phones that were actually designed specifically to be the best form of wireless voice communication? I sure wish I could buy a new manufacture Motorola StarTac today!! Black-on-green screen - NO crappy color screens. No stupid ring tones. No photo album. No crappy camera. Two-WEEK standby time!! Just a damn good PHONE...nothing else.

/rant

Re:All I want is a phone!

[Anonymous Coward]

That sounds as a typical linux flame war fan... Missing features in order to satisfy science...
Repeat with me: "Science is about giving better alternatives to the humans, no a restricted set of ones!!!"

Re:All I want is a phone!

[Zemplar]

Alternatives? Yes, alternatives that have poor battery life and just generally don't function as well as phones, and eeek, are susceptible to VIRUSES!!

Re:All I want is a phone!

[Anonymous Coward]

You can still buy phones with only the features you listed. And besides that, bluetooth is a communication tool, as it allows you to use your mobile is a modem for your laptop, IE it is not a wanker-feature.

Oh, and it's great you only want that from your phone. So? Others want their phone to do more.

Re:Another FUD from F-Secure

[Ilgaz]

You blame F-Secure, makers of F-prot distributing FUD?

How old are you? 16?

Read some IT history about F-Prot. You will understand they really don't care about your $something.

I am just afraid of people like you administering Symbian sites, really afraid.

If I ever buy f-prot for my mobile, if there will be a reason ever, it will be people like you.

How many users of you care about exact 3 warnings when they download/purchase any sis from your site?

For people never used Symbian, you must PAY to Symbian/Nokia as a developer (free or not!) to get a "security signature" for your application.

I'd expect something like "This is what Nokia deserved, they tried to rip off developers by Symbian security signature and entire community 'learned' not to care about security alerts"

Not some bs like F-secure cares about your money.

I just wonder how many threats Karpersky labs does found and not announcing because of people like you. Who are them? Oh, just another crooks, going for money!

Has anybody RTFA?

[Anonymous Coward]

From the TFA:

"They spread very slowly, in large part because most of the mobile phone software has integrated security protection," he said. "But if someone can find a way around those security settings it could be a significant problem."

Before infection you get multiple warnings before you install the malware.

So, in fact, the OS manufacturers are already making the OS secure (modulo the caveat that no OS is truly secure, bugs will be found etc).

Re:Has anybody RTFA?

[DrSkwid]

Before infection you get multiple warnings before you install the malware.

When infection is attempted one is presented with this :

Install Cabir ?
Yes . . . . . No

What a disappointment...

[zombiestomper]

I thought they meant Sybians.

(fud my ass in fact)

[Ilgaz]

The symbian community learned to bypass all security alerts saying "yes, yes".

You know the reason? Even the best symbian coders have to instruct users to IGNORE security alerts because they can't afford to buy a Symbian signed license for their application.

Only being a user, I suppose Nokia wants money for it.

About your OT: Got no spam for 3 weeks, looks like even spammers have some kind of brain ;)

Re:Want a surefire solution?? I have the answer.

[Illserve]

Before anyone else chimes in, yes he's being sarcastic.

ease down Ripley...

Re:Another FUD from F-Secure

[AppyPappy]

" This theme is beat to death. So called "virus" require answer "Yes" three times to be installed."

It was the same for computers 10 years ago. Now they can infect you without your knowledge by going down wire. How long before our nation's high schools are one big spambot farm?

If we are going to put computers in phones, we need to put firewalls and anti-virus protection in them with the ability to be updated. Which is a security hole itself. In terms of computer technology, it is 1995 in cell phone land. Somewhere, some 1337 h4x0r is working on a way to slide his technological penis into the cell phone vagina and make babies.

Or will...

[Marthisdil]

or will the OS creators have to start making their software secure?"

Or will people like the OP finally come to realize that when it comes to code, there's usually something broken in it - no matter how big or small, and someone who takes the time to figure it out, will almost always figure a way in?

I bet the OP thinks Linux is secure too.

Re:Or will...

[Anonymous Coward]

Yes, god forbid the OS was secure from the start. Then the anti-virus industry would crash or even worse, people might not even need to update their OSes and MS programmers might lose their stock options. MS and Apple's stock would go down, the IT industry would take half as many "geniuses" as it does now. Yes, it would be terrible. Keep leaving those bugs and security holes in there.

Re:Another FUD from F-Secure

[Slashcrap]

I just wonder how many threats Karpersky labs does found and not announcing because of people like you. Who are them? Oh, just another crooks, going for money!

You statements about Symbian bringing this on themselves by charging so much to sign executables are perfectly valid, but the one above is just bullshit.

Kaspersky _are_ well known for scaremongering and nothing you can say is going to change that. Remember the recent "OMFG teh Internet is DOOMED!!!11!!1" statements from their CEO? What happened with that? Is the Internet still working?

And since you decided to launch a personal attack on the original poster, I'm going to do the same. You sound Russian. And to have such strong views about the company I would suggest that you must have some kind of relationship with them. I think you're shilling.

In Soviet Russia, scares monger Kaspersky.

Don't repeat after you.

[Anonymous Coward]

You're an idiot. Set the BT on and visibility on. Just don't install any shit that happens to come there.

Re:Don't repeat after you.

[jcostom]

Want to leave BT on? Fine by me. Why do you need visibility on all the time though? Toothing? You flip on visibility, pair with whatever device you want to pair with and shut visibility back off.

Being married, I've got no need for toothing..

There's no such thing as 'Toothing

[MuMart]

But you can still get f*cked.

Trouble brewing

[taneem]

All the big companies, from the PC, the gaming console, the PDA and the cellphone sectors are focusing on the convergence of devices. Which is why the nintendo DS has a stylus, the Dell PDAs can play music etc. etc.

Eventually these people are picturing a superdevice that you would use for everything from entertainment to buying gas at the filling station.

In comparison to the complexity of such a device, something like Symbian OS is pretty primitive. So if they have such flawed design methodologies right now (more than one virus released, complaints from developers on /.) it does not bode well for us in the future.

I don't want to have to deal with superdevices that contain my critical information and run on software with the reliability of MS Windows. Companies like Symbian need to look at the basic design of their systems, and make them inherently better from the start to prevent mobile devices from suffering the same fate as PCs.

Re:Symbian team are fools. I interviewed with them

[Xiarcel]

>>statisc data files ..
>>malfromed photos,

malformed english?

FUD

[MegaFur]

http://www.vmyths.com

Re:FUD

[Ilgaz]

Oh boy, we will spend a long time for nothing.

Viruses exist for Symbian, they really spread. Nobody will come up and say "Hey, I had taken my nokia 7650 to service because my one of (install cool name here) program 10.000 cracked app cd "

You all go out once in a while, like big concerts, make your phone visible and see if it exist or not.

http://www.f-secure.com/corporate/intro.shtml

It really looks like they want to sell software to couple of symbian geeks and threatening their reputation since 1989, yea right.

Parrallel universe exists, at long last the proof

[Anonymous Coward]

This is a miracle! imipak, you just cracked one of the biggest riddle in fundamental physics.
You live in world contained in a parallel universe where the USA also exists and happens to have the lowest muder rate in the world!
Dude, can you at least tell me how you have achieved posting to /. from there? I'm really keen to know!

Yet another reason...

[Havenwar]

to stick with my old cellphone.

I mean, seriously... since technology advances and makes old tech cheap, I really dont understand why the companies dont release a "budget model" that just has a phone and thats it. Yeah, I know, revolutionary idea, but seriously...

Phone = making phonecalls. Any advances should be put into how well you can make them, and how good you can hear the other person, and not how many pictures you can store and still fit a signal of whatever wacky show your currrently watching that you will have to listen to the end of every time before answering.

Maybe you're not that experienced with Symbian

[Anonymous Coward]

As an employee of one of the companies mentioned in the main posting, it's obvious that you really don't know what you're talking about. The latest version of Symbian contains numerous updates in terms of security... does "Platform Security" ring a bell? These security updates even break backwards compatability with apps built for older versions, but security has been deemed more important. As for your comments on debugging... I'm involved in hardware-level debugging at the kernel level in Symbian EVERY DAY!!! There's also a console AND a DEBUG UART to log to. You can log to IrDA and Bluetooth as well. I develop using a text editor and the command line, not Code Warrior, and it works just fine. This is because the development environment is NOT based on Code Warrior. Code Warrior's just a tool, and is NOT necessary to develop for Symbian. By the way, using GCC as the compiler has caused us NO problems since we became a Symbian shop... NOT ONE. Maybe you should try actually developing on Symbian and LEARNING its INTERNALS before you spread such FUD.

Re:Symbian team are fools. I interviewed with them

[Anonymous Coward]

So you failed the aptitude tests then?
I also interviewed with them and got a job. Pity i won't be working with you.

Will the real malware please stand up?

[DickBreath]

Well, maybe the true viruses are so advanced that really no one has a clue about their existence (which would be the reason why you don't hear of them), and the "permission to install" viruses are actually a way to detract attention from them ...

Maybe all the malware is a way to distract attention away from the real malware.

What if the real malware is the one that you willingly agree to install. Pay huge amounts of money for. Give up your freedom for. Give up control of your hardware. Willingly build up your oppressors by using. Allow yourself to be restricted, managed, legislated, licensed, and phone home for permission (activation code) when you need to change your hardware. Lock yourself ever more deeply into that particular malware system making it ever more difficult to escape.

Well, okay. Maybe not. Nevermind. Please go back to consuming.

Re:Will the real malware please stand up?

[confused.brit]

Hmmmmm....

iTunes anyone?

And could someone for the love of Mike please put a 20sec countdown timer on the post screen!!!!!

good old days

[hicsuget]

Remember back when telephones made phone calls? Back before they started doing all this hoity-toity nonsense like surfing the web or taking pictures of your girlfriend's sister's panties under the dinner table? I miss those days.

Aha!, but... Re:Handheld viruses

[hacksoncode]

The next stage of such viruses is clearly to hot-sync to your host computer and infect files that live in your backup areas.

So there!

The other option

[mwood]

Go back to stupidphones. My now-ancient StarTAC does everything I want in a telephone, and a lot of stuff I'd like to take out of the menus altogether. If I wanted to lug around lots of other functions, I'd keep them in a separate piece of equipment and only connect it to the phone when I need to connect to somewhere else.

Either that, or just carry a general-purpose computer and plug in a wireless module when I want to have it emulate a telephone or obtain some networked service.

Re:Another FUD from F-Secure

[Ilgaz]

"Kaspersky _are_ well known for scaremongering and nothing you can say is going to change that. Remember the recent "OMFG teh Internet is DOOMED!!!11!!1" statements from their CEO? What happened with that? Is the Internet still working?"

Mr. Karpersky didn't tell it, it was an employee of labs in a conference speaking about a possibility if the framework of Internet is not changed.

I am not russian, Ilgaz is not a russian name, I don't hide behind nicks. If I were narrow minded like you, I'd be hurting their business because of political reasons. Now I have same question for you... Do you have political relationship (positive or negative) with russia?

I have seen Karpersky antivirus installed in 10.000+ user networks, mainframes. As a computer hobbyist, I respeck them. BTW, nobody here looks as decision makers of corparate environments or able to afford karpersky license. Just a bunch of teenagers bullying industry legends as F-Prot and Karpersky.

In fact I use licensed Intego antivirus and Firewall on OS X, bite me!

Damn that Microsoft!

[Anonymous Coward]

Gosh once again Microsoft has dropped the ball --oops - not a Microsoft phone - nevermind

Re:Symbian team are fools. I interviewed with them

[Anonymous Coward]

Sounds smarter than you do.

Re:All I want is a calculator

[Anonymous Coward]

because computers are susceptible to viruses !!

Made in the USA? W00t!

[Anonymous Coward]

From the description in the first URL you provided:

Goldbug is a complex virus, made in USA.

Be proud to be an American. Be sure that you only run virii that are made in the USA!

MOD PARENT -1 LUDDITE WANKER

[Anonymous Coward]

your geek credentials have been revoked, please leave this website and hand your badge in at the front desk

Am I the only one that misses some of the great cell phone

let me guess you're American ?

Re:Another FUD from F-Secure

[Anonymous Coward]

I say outright - not insinuate - that you are incapable of detecting sarcasm.

There have been SOME advances

[Anonymous Coward]

I don't know how you got two weeks out of your startac.. mine only lasted two hours if i unhooked it from the car charger. You couldn't fit the thing in your pocket so you either left it in the car anyway or walked around with a stupid-looking phone holster. I imagined self-important geeks dueling in the old west drawing their phones and ... dialing first.

What makes the black-on-green better than a 10-digit calculator type display? (Not that i'll deny that screens that require backlighting are pointless for a device that should be maximizing battery life.)

There've been some advancements. You seem to be upset because the extra features are eating up all the real enhancements (higher density batteries, lower/variable power transmitters, etc)

Simian phones?!

[Anonymous Coward]

Oh no!!! The planet of the apes is here!!! Oh wait...

Re:Want a surefire solution?? I have the answer.

[deserttrail]

Just to poke a little fun at your article (in the context of the discussion): The number one city, Washington DC, doesn't have a death penalty.

too true

[circusboy]

I had a long conversation with sprint support about this, and they were willing to do it, (downgrade me for free to a barebones phone that is.)
I then discovered that the phone I had, (the screen had died) had a free replacement policy. (It was a sanyo clamshell, I forget which model.) of course the replacement then broke a week later. I have since downgraded back to my original sanyo 4500 or whatever. better range, longer battery life... the only down side is that the clock does not work out of sprint pcs range. so no alarm clock.

Sprint it seems is reluctant, but not completely opposed to giving you the low end "phone-only" handset if you want it. but for the most part, (in my admittedly limited experience) is that the phone support people are much nicer than the people in the stores. (hear that clackamas?!? though the guy near lloyd center was nice. (portland, OR for the curious))

On the other hand I just switched over to a t-mobile/nokia/symbian 60 phone. Which does not have much service in the area where I am currently (temporarily I hope) stuck. (north-eastern vermont for the still curious)

Re:Want a surefire solution?? I have the answer.

[mxyzpltk]

As of 1996, your categorization of the US's murder rate as "one of the lowest in the world" is misleading. Only 23 of 86 surveyed countries had higher rates.

http://www.haciendapub.com/stolinsky.html/

Despite pro-death marketing, studies pretty consistently show that capital punishment has no deterrent effect.

http://www.csicop.org/si/2004-07/capital-punishmen t.html/

In fact, murder rates tend to go up during periods in which death sentences are actually carried out.

http://www.prisonactivist.org/death-penalty/dpstud y.html/

Oh dear, oh dear, oh dear...

[Anonymous Coward]

Upset because we failed the selection process?

Well, I had an interview with them and got the job. Shame they didn't let you in. You would make an excellent office clown...

Re:Symbian team are fools. I interviewed with them

[Anonymous Coward]

Yes, parent is flamebait. However, he's right ... I work at Symbian, and to be blunt, they're DRM whores. We've got agreements with the MPAA and Microsoft up the wazoo, with a lot of legal pressure from the contracts ready to lawsuit us out of existence if we dare to allow options for non-DRM media.

Before you ask, yes, I'm looking for other employment, preferably in an open source company using Gentoo (follow up if you know a company that might interest me (-: ). I'm assuming a GPL source company won't support DRM ... my plans for moving are purely idealistic.

Re:Symbian team are fools. I interviewed with them

[Anonymous Coward]

Well, I've been here at Symbian for nearly a year now, and I have to wonder who interviewed you.

We have hacker personalities. We have managers. The managers keep us on target and the hacker personalities write the software.

It sounds very much like someone couldn't write a Soundblaster driver.

Oh, and by the way: you'll have to look elsewhere for your attack vectors. None of those you listed are feasible.