In-depth

Is mobile malware really a risk?

Following on from the Samsung Wave and HTC Magic shipping with a malware-infected microSD card, we investigate into how much of a threat mobile malware is.

9 Jun 2010

.polaris__post-meta--date { display: none; } .polaris__post-meta--date.no-script { display: block; padding-left: 45px } 9 Jun 2010

"There is iPhone OS, Symbian, Windows Mobile, Android, Web OS etc. This makes it more difficult for the hackers and cyber-criminals. They have more choice, but limited resources to deploy," he said.

"They are used to the world of the PC, one very large homogeneous market that they can develop their malware for and which they can iterate, relatively easily. This is not the case with the mobile environment at the moment and this is providing an inhibitor to the wide-spread deployment of malware."

The issue of mobile malware isn't just limited to smartphones, either.

Rob Bamforth, principal analyst of Quocirca's communication, collaboration and convergence arm, said any platform can be attacked.

"Phone phreakers used to attack phone systems long before we all had personal computers or digital telephony, but the attacks on feature phone users are more likely to be social engineering (SMS fraud etc) or for those supporting Java, there's a risk there too," he said.

The problem of mobile malware will only get worse, too, because the openness of the approach allows any developers to pitch up with their app or software.

"Given the rapid development of this software and the limited barriers to entry, it poses the dilemma to determine the reputable vendor/app from the disreputable/malicious apps," Mallon added.

"There is implicit trust with open software and platforms - that everyone is altruistic and doing it for the good of the development community. However, we all know that trust can be broken and exploited."

Bamforth added: "gullibility and greed are evenly spread, so just increasing the number of smart' platforms increases the total system risk mobile malware can use social engineering attacks (phishing etc) just as easily, perhaps more easily, as in a desktop context.

"With smaller screen real estate and busy' timescales, people respond more in haste when on the move, so the risks of clicking on a link that goes somewhere bad is probably higher."