Malicious Code Moves to Mobile Devices

Computer T he program was called Liberty Crack, and it first popped up on an Internet Relay Chat group. It was a Trojan horse, a program that includes malicious or harmful code in apparently harmless programming or data. Although it did not cause major problems, Liberty Crack proved significant because it targeted handheld devices. Such devices, which have communications and Internet-access capabilities, have become popular only recently and thus have not been significant targets of Trojan horses, viruses, and worms. Now, however, malicious-code writers apparently realize that the relatively new intelligent-mobile technology has security weaknesses. Liberty Crack thus may serve as a wake-up call for the handhelddevice and network-security industries. “It exposed the underlying fact that destructive applications can be built on any platform, and given a lack of security or precautions, harmful results will ensue,” said Kenneth Smiley, a senior analyst with Giga Information Group, a market research firm. He added that the Liberty Crack incident might inspire more Trojan authors to write malicious code for mobile platforms. In fact, a virus and a Trojan horse that affect the PalmOS were recently discovered. Not only could malicious code wipe out and damage data, applications, and operating systems in the future, it could also infect other handheld devices and spread across networks and the Internet to PCs, workstations, and other machines. Currently, a relatively low percentage of handheld devices have communications capabilities. However, market research firm IDC estimates that by mid2001, a majority of cellular and PCS telephones worldwide will be Internetenabled using the Wireless Application Protocol (WAP). IDC also predicts that by 2003, vendors will sell more than 19 million PDAs and 13 million smart phones worldwide and that 61.5 million mobile users will have two-way Internet access. As the figure on the next page shows, mobile-device vendor Ericsson predicts that mobile Internet access will increase much more rapidly than fixed access. According to Ericsson, most Internet access will take place from mobile devices by the second half of 2003. Therefore, vendors and users of handheld devices, such as smart phones and personal digital assistants (PDAs), are beginning to acknowledge the need for protection against malicious code. Several antivirus software companies are already developing products for handheld devices. However, the handheld community is likely to find itself in an arms race with virus writers looking for ways to defeat antivirus systems, as has long been the case with the PC community.