It really is only a matter of time before the threats become very real so it possibly is time to start considering anti-virus protection for your handheld. I'm not too concerned yet but after reading several advisories lately, I am thinking about it more often.
And yet it seems to me that there is a strong chance that the anti-virus program that is protecting my PC might well offer me some protection...or one would assume it might. As I see it, the only way I am going to get a virus is through email or from active sync. In my case, active sync is the more likely to cause the problem. I hope that my virus protection on my PC might look for some hidden virus lurking in the background waiting for an active sync connection before it initiates .... well, at least I hope so.
You might find the following of some interest..it is what sparked me to write my comments.
MARA research group discovers world’s first PC to handheld crossover malware
Source:
Mobile Antivirus Researchers Association
www.mobileav.org
Date: February 27, 2006
Advisory:
The Mobile Malware Researchers Association (MARA) today announced that it has characterized the first malware to cross-infect a handheld phone or PDA from a binary on the desktop PC. The malware, a Trojan dubbed “crossover”, spreads from a Win32 desktop machine to a Windows Mobile Pocket PC handheld. Detailed analysis and the malware binary are available to antivirus companies and security experts who qualify for MARA membership, which is free.
Crossover is the first malware to be able to infect both a Windows desktop computer as well as a PDA running Windows Mobile for Pocket PC. It was sent to MARA anonymously.
Included with the malware was the following text file:
______________________________________
virus name: crossover virus - proof of concept
virus type: multiplatform
Target Platforms: Windows desktop OS's, Windows ce, mobile with .NET CF 1.1
This is a proof of concept virus that shows how a virus can spread from a desktop computer to a pocket pc. With the growing use of handheld devices this type of virus may become very prevalent in the future. For viruses to be more effective they need to spread across a wider range of devices including wireless devices. AVers have to be able to provide adequate protection to deal with these types of viruses. The crossover virus is named so because it crosses over from wired PC's to wireless pocket PC's. It is the first virus of its kind. When executed the virus checks what the current OS is, if it is not windows ce or mobile the virus makes a copy of itself and puts a startup command to the copy in the registry local-machine-current-version-run, the virus then quietly waits for an activesync connection to be detected, it can wait infinitely and everytime the desktop is rebooted the virus recreates itself and again add new copies to the registry, theoretically you can have so many copies running on startup it could degrade or halt the PC's performance. When an active sync connection is detected the virus copies itself to the handheld device and remotely executes the virus to start running on the device.
If the current OS is windows ce or mobile the virus erases all files in the \\My Documents directory of the device. Then it copies itself to the \\Windows directory and creates a shortcut to the copy in \\Windows\\startup. When the device is reset the shortcuts execute their target files, here also you can theoretically have multiple copies of the virus running on startup.
The crossover virus was written in C# (C Sharp) using Visual Studio .NET 2003, the Communications Library of openNETCF.org was used and a great help. It should run on any handheld device running windows ce/mobile and .NET CF 1.1
This is proof of concept code for educational purposes only. This virus closes the gap between handhelds and desktops, now its one big world open to all.
______________________________________
More information, code and sample binaries are available from MARA http://www.mobileav.org
Copyright (c) 2005 Mobile Antivirus Researchers Association.
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of MARA. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please contact MARA for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use on an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
No comments:
Post a Comment