Mobile malware: is it for real?

Although alarming reports about mobile security mishaps abound, the problem is exaggerated—at least for now.

Everybody and his granny’s using a mobile phone nowadays. Does that mean that we’re all at risk from the same threats that plague our PCs? Not quite. First off, unless you’re using a smartphone, you’re mostly safe even though most mid-range phones nowadays come with Bluetooth and that’s another problem altogether.

That said, Bluetooth and its associated blues are easy enough to deal with. Simply turn off Bluetooth when you’re not using it. Even if Bluetooth is on, the protocol does come with some degree of security. There are security levels, and if you’re paranoid all you have to do is set the level of Bluetooth security to high. Otherwise leave it at medium. In any case, you’ll want to keep it off when you’re not using it as Bluetooth sucks up power like an industrial vacuum cleaner.

The fact of the matter is that just setting Bluetooth to a “non-discoverable” mode prevents your phone from showing up in a Bluetooth device search.

The second thing that we have to worry about is theft or loss. One way to mitigate the gnawing agony of losing a phone is to type *#06# into your phone. This will display your phone’s IMEI number. Note it down and store it in a safe place ‘cause this number will help your service provider bar the handset if it’s lost or stolen.

Now that we’re through with the easy stuff what about those of us who do use smartphones. They have a harder road to tread. Smartphones are ‘smarter’ in the sense that they’re more like PCs than phones. They run applications on an operating system that’s susceptible to malware. Symbian and Windows Mobile are two popular smartphone OSs. Both have been targeted although on the ground instances of infection are still on the lower side perhaps because most smartphone users don’t really use all the functions that these devices offer or are simply not exposed to the public Internet through GPRS/EDGE.

What if you are trawling the Net on your smartphone and downloading freebies willy-nilly? There is hope. Most anti-virus vendors have mobile versions of their PC software. Alternatively if you’re keeping vital information or trade secrets on your phone or if your contacts are worth their weight in gold to you, then you might want to consider an encryption solution. Most of these are aimed at corporate users and they let you disable lost or stolen devices so that data doesn’t fall into the wrong hands.

Over time, more and more of us will start using smartphones. Which is why the industry is getting together to frame a spec for manufacturers to store data securely on a mobile device. The Mobile Trusted Module (MTM) spec is one such initiative. It’s backed by the likes of Nokia and Samsung. The MTM sets aside a part of a mobile device’s memory for safeguarding information and making sure that the phone’s operating system, apps and data haven’t been tampered with.

Smartphones represented 6.1 percent of all the handsets shipped worldwide during 2005 as per Gartner. Which is why some analysts including those from the Yankee Group feel that software vendors are beating the war drums a tad too soon.

For you see, unlike on your PC where most of us run Windows, smartphones may run any of a bunch of popular OSs including Symbian, Windows Mobile and embedded Linux. For now, it’s a matter of specifying usage policies for smartphones and extending password and data access policies to these devices.

I’ll leave you with Juniper Research’s findings that there has been a steady rise in security attacks on mobile phones. They predict that mobile security products will be installed on 247 million mobile phones (about 8 percent of overall shipments) by 2011.

Highlights from the report include:

• Mobile phone theft will continue to rise with nearly four percent of mobile phones being stolen annually by 2011
• Revenues from mobile security products, including anti-virus, VPN, data and file encryption and mobile identity management applications, will generate almost $5 billion in revenues by 2011
• The biggest mobile security market sector will be the secure mobile content sector (anti-virus, anti-spam, anti-spyware and content filtering) accounting for 40 percent of this market
• Revenues from mobile data and file encryption products is expected to outstrip the PC market for such software by 2011
• Mobile Biometric solutions will contribute $268 million of the total mobile identity and access management market ($1.36 billion) by 2011

In the words of report author Alan Goode, “Initially driven by the data hungry mobile business user who has seen the benefits of data services such as e-mail, predominantly on their Blackberry devices, we will see mobile security products go mainstream by late 2008 or early 2009 resulting in a doubling of revenues from 2008 to 2010.”

So, while mobile malware isn’t exactly a show-stopper today, it will be five years from now.

prashant.rao@expressindia.com