If you've followed WMExperts for awhile, you've probably noticed that we've glanced askance at anti-virus or other malware solutions for Windows Mobile.  The bottom line is that the threat doesn't seem big enough to warrant the performance hit that you'd get by running anti-virus on your smartphone.  In fact, so far as we know, there aren't any serious viruses or other threats out there at all right now.  Nobody here runs anti-virus and nobody here recommends that you do either.

Of course, making such a blanket statement isn't so cut-and-dried -- it's always possible that something nasty could crop up and it's legitimate to be worried about it.  We just received an email from David in this vein.  Find it and our answer, after the break!

(Have a question for WMExperts?  We've added a new "Ask WMExperts" category to our contact form - that's the place to do it!)

Read the rest of this entry »

This is the first “in the wild” Windows Mobile malware I can remember off the top of my head. It was discovered in China and written up over at McAfee. Basically if you downloaded a games pack (including Google Maps in that pack) from a certain Chinese website it installed a piece of software that did the following:

• Silently makes your smartphone accept unsigned applications
• Installs a hidden, difficult to remove program that sends your personal information back to home base
• Installs a copy of the malware on your memory card for further spreading.

The site has since been shut down (despite protests from the developer that he didn't mean to do anything evil). It's a bummer, though, I am not keen on installing anti-virus on my smartphone.

The InfoJack Trojan spreads by either tricking mobile users into installing seemingly legitimate application installation files or if punters inadvertently use an infected memory card on vulnerable devices. The malware has been spotted circulating in China. - Register

Anybody running anti-virus / anti-spyware on their smartphones? How's your performance?

Here we go again, McAfee has released a white paper (PDF link) telling the world that, yes Virginia, you can write malware for Windows Mobile. This seems to happen every few months when this anti-virus company or that doesn't feel it's getting enough attention. Of particular note to McAfee researchers is Windows Mobile's SMS API (which enables cool software like Mobile Secretary's SMS auto-reply and forward), which they say could allow ne'er do wells to grab your personal info via text.

Anyhow, before you run for the hills, note that an exploit hasn't been released.

While mobile malware attacks have been scarce thus far, and some experts -- including F-Secure wireless security guru Mikko Hypponen -- have predicted that such threats will likely never rival widespread nature of today's desktop viruses, McAfee maintains that as smartphones takeoff more exploit code will be written to target the machines.

Read: InfoWorld

I really, really, really don't want to ever have to install antivirus software on a smartphone. For what little risk is out there right now, it's absolutely not worth the program memory for me to do it. If you're the paranoid type, however, feel free to toss money at Mobile AntiVirus. I won't call you a sucker -- to your face.

Symantec Corp. has announced its Mobile AntiVirus 4.0 for Windows Mobile, developed to work on Pocket PCs and smartphones running on the Windows Mobile 5.0 platform. The software automatically protects mobile devices from threats transmitted via e-mail and multimedia messaging service (MMS), downloaded from memory cards, the cellular network and Wi-Fi, transmitted by Bluetooth or beamed over infrared connections.

Read: Symantec releases Mobile AntiVirus 4.0 for Windows Mobile

Stop the presses: A Microsoft software product has been found to have security flaws.

Ok, cheap shot. And really, WM5 hasn't, to my knowledge, had any sort of catastrophic attack on it yet. Even this is just a report of a threat, not an actual attack (a report of a threat, one should note, from a company that wants to sell you software to protect you). Still, MS is on the case and, really, it should just be a matter of time before we really have to starting thinking about malware on our smartphones.

Which amuses me, my two main platforms (Windows Mobile and Mac) are both pretty much malware-free. So I suppose the same thing people argue about WRT Macs could be applied to WM5 - is it security through obscurity? Good secure software?

Trend Micro has told Microsoft about the problems and has not publicly shared the vulnerability details. "The sky isn't falling. Nobody out there is aware of this," Thiemann said. The company doesn't expect any imminent attacks exploiting the problems, he said.

Read: Windows Mobile flaws could crash phones - Security - News - ZDNet Asia

Well that's bad news: The Register is reporting that it's possible to send a malicious MMS to Windows Mobile phones (at least Pocket PC 2003 and Smartphone 2003 phones) that could possibly infect them with malicious code. More likely it would just crash the phone (thank god for small favors), though, as it's apparently wicked-tough to implement.

All in all, we've had a remarkably long honeymoon when it comes to security on mobile devices. Hopefully it's not over yet.

Security researchers have released proof-of-concept code that exploits vulnerabilities in MMS implementations in mobile phones running mobile versions of Windows.
[...]Even in devices confirmed as vulnerable the attacker needs to know the correct memory slot where the MMS processing code is executing, so exploitation is far from easy. Malicious MMS message will most likely only crash a device rather than infecting it, reports anti-virus firm F-Secure.

Read: How to crash a Windows mobile using MMS | The Register