Are Cell Viruses A Real Threat Now?

Celpha writes "According to security firm F-Secure, a Trojan virus (Cardtrap.A) attacks Symbian mobile phone operating systems, attempting to infect users' PCs if they insert the phone's memory card into their computers. From the article: 'We expect to see more of this on the mobile front,' an F-Secure chief research officer said. Trend Micro issued a media alert stating it is a 'fully functioning' mobile threat. However, Antivirus firm Sophos slams the claim of this first example of a serious mobile malware threat as just plain bonkers."

Comments

Heh

[Walkiry]

'We expect to see more of this on the mobile front,'

I bet you do, as you are probably already hard at work to make it happen.

You better believe it's a threat.

[TripMaster Monkey]

TrendMicro claims that the Symbos_Cardtrp.A trojan is a "fully functioning threat", while Sophos dissmisses the entire thing as "bonkers". I'm thinking that the truth is rather in the middle.

The Symbos_Cardtrp.A trojan is one of the first clumsy attempts at this sort of thing, but we all know that the malware only gets more sophisticated and polished over time. People certainly should be alarmed about the appearance of this trojan...not because it itself is all that threatening, but because it clearly demonstrates the potential for mischief.

As Raimund Genes, president of the firm's European Operations, said: "This attack is really a proof of concept and may be an indication of a new type of blended threat to come." You can bet that as cellphones become more sophisicated and more interconnected to our computers, malware authors are going to turn this into a genuine threat.

In short, while it's rather sensationalistic to tout this as a "fully functioning threat", claiming that there is nothingto worry about disingenuous in the extreme. Sophos' claim that paying attenton to this threat distracts sysadmins from the "real threat" of attacks on Windows desktops is pure sheepdip. Imagine if we dismissed out of hand the new threat of infection via USB thumbdrives, because we were all too busy paying attention to the "real threat" of infection over the network?

Re:You better believe it's a threat.

[Anonymous Brave Guy]

You can bet that as cellphones become more sophisicated and more interconnected to our computers, malware authors are going to turn this into a genuine threat.

An objective observer (which the various anti-virus people probably aren't) might ask why a mobile phone needs to become "more sophisticated" in the first place. My phone was a freebie about four years ago when I signed up, and still has way more features than I ever want or need.

Give me a good phone book feature, voice, text messaging and some sort of answerphone if I can't take a call. I don't need it to be a low quality digital camera, hard-to-use PDA, sub-standard web browser, trivial calculator, poor-capacity MP3 player, pathetically quiet alarm clock, and all the other junk. Nor do I need it to run some super-complicated operating system that's ripe for attacking.

Re:You better believe it's a threat.

[black mariah]

My phone was a freebie about four years ago when I signed up, and still has way more features than I ever want or need.

I highlighted the key words there for you. You may not use those features, but someone does, and probably on a very regular basis.

I don't need it to be a low quality digital camera, hard-to-use PDA, sub-standard web browser, trivial calculator, poor-capacity MP3 player, pathetically quiet alarm clock, and all the other junk. Nor do I need it to run some super-complicated operating system that's ripe for attacking.

So you'd rather carry around a camera, a PDA, a calculator, an MP3 player, an alarm clock, and all the other junk instead of having it all in one convenient package? I hope you have a lot of pockets...

Cell Viruses are the most common!

[Anonymous Coward]

I thought the computer term virus CAME from Cell Viruses. Now we are using Cell Virus to talk about cell PHONE viruses?

yeah, my Motorola phone caught a cold, and it passed it along to my PC.

Just Windows.

[kihjin]

If you are going to quote some one, quote them completely.

From TFA(emphasis mine):
"We expect to see more of this on the mobile front," Hypponen said. "We may begin to see Windows viruses spreading to PDAs that are synched up to computers, or go from PCs to mobile phones with the memory card."

Focus you energy.

[OctoberSky]

I am calling on all hackers and script kiddies to stop writing malicious code for cell phones and start writing codes that allow me to get a connection (place a call) without my carrier knowing.

$39.99+ is far too much to pay per month. I want free calling. And I am not talking about cloning, I am talking about getting on Verizons antenna and placing calls from my phone without them seeing it, or seeing who owns the phone.

Simplicity is the key to beating this easily...

[Anonymous Coward]

Just buy a damn PHONE. You know. Those things that used to just go ring-ring, and you pick it up and talk on it and maybe keep an address book on? I still use a Motorola V60 flip phone. No windows/PalmOS/WinOS/WinCE/PocketPC/2003 crap to worry about. Ring tones? No thanks. I'm not 13 anymore, trying to make some sort of 17-second "statement" to the crowd around my ringing phone. Sometimes simplicity is the key. K.I.S.S. metheodology is still around for a reason.

Got paid to develop Trojans

[Anonymous Coward]

I got paid by a major company in the mobile field to develop Trojan horses for Java, Symbian, PalmOS and Windows Smartphone.

The goal was not to release "in the wild" but to showcase the need for funding for mobile phone security.

Nevertheless, pretty much nothing has been done even though modern smartphone OSes are incredibly close to allowing excellent OS security (MMU enables kernel / user separation).

It's pretty easy to do fancy stuff once you get in the mindset of an attacker. Like waking up the phone at midnight to place calls to a premium number. One doesn't even need to stack-smash to have fun (that is harder on ARM platforms bc you have to develop your own shellcode anyway).

The problem is especially important for wireless operators because people pay with their mobile phone. While that is the basis of revenue, it also enables major fraud (very much akin to what the "dialer kits" do to modem owners by silently ringing 900 numbers).

Examples:

  * There's a WAP (wireless browsing) service where you can download ringtones for $2. What if a program on your phone starts downloading those silently?

  * In some countries SMS are charged with a premium. What if a program are sending premium SMS without your knowing?

Of course it's also important for users ("what if a Trojan posts my phone book to some website", "what if a Trojan gets my location from the network and gives it to my wife". It's also important for security that the phone not be transformed into a jammer by changes in the radio firmware / software, but that's harder to do.

Hopefully the players involved will wake up before we find a nasty one in the wild.