Viruses Find A New Host: Cell Phones 173
An anonymous reader writes "A NYTimes article (free reg) describes the dangers posed by viruses as 3G and text-messaging become more common, inluding an incident in '01 where numerous phones in Japan began calling 110 (equivalent to 911 in the U.S.). Wired mentions 13M vulnerable phones in Japan alone." (And that was a few years ago.)
nothing is safe.. (Score:1)
Re:nothing is safe.. (Score:5, Funny)
Oh what a virus writers dream. A whole house on the fritz.
Re:nothing is safe.. (Score:5, Funny)
Even worse, your Nutri-matic drink dispenser could start producing beverages that are almost, but not quite, entirely unlike tea.
Re:nothing is safe.. (Score:2, Funny)
You don't need to wait for a virus. children are more than capable of all of these activities!
Oh, wait ....
Re:nothing is safe.. (Score:2, Funny)
Too late.
Virus HAH!!!! (Score:2, Funny)
Welcome your new cellphone overlords (Score:2)
Since newer generations of phones, with new features, are just being made with upgrades to the old OS, that means new bugs and security holes are just being layered on top of older ones...
Anyway, it will probably be for the best when 'standard' phone OS's become ma
This is only going to get worse (Score:1, Flamebait)
Re:This is only going to get worse (Score:1)
The fixes, or the vulnerabilities?
Re:This is only going to get worse (Score:1, Redundant)
Re:This is only going to get worse (Score:4, Interesting)
Re:This is only going to get worse (Score:1)
A play on words?
Re:This is only going to get worse (Score:2)
Re:This is only going to get worse (Score:5, Informative)
Virus as surveillance ware (Score:4, Insightful)
*chuckle* The next couple of decades are going to be interesting.
They already do surveilance on mobile phones... (Score:3, Interesting)
There's been a couple of murderers and rapists and the like in the UK lately who have been caught based on mobile phone records. A murder trial - two young girls, very nasty - that's currently taking place involves the evidence that one of the victim's mobile phones was switched off outside the suspect's house the evening that the girls went missing.
It's all fairly simple stuff at this stage, though it's kinda the stuff we've been seeing in films for years and scoffing at on the basis that it's "so unreali
Reg Free NYT Link (Score:5, Informative)
They are not Viruses (Score:4, Funny)
Re:They are not Viruses (Score:4, Funny)
Re:They are not Viruses (Score:2)
Now, virus did start life as a Latin word (meaning 'slime,' or 'poison,' or 'bitter taste'), so I think it's fine to use the Latin plural viri. But as it's used in English, virus has a meaning different from that of the Latin word, so I think it's also fine to use the English plural viruses. If you do go with th
Re:They are not Viruses (Score:2)
virus -i n. I. a slimy liquid, slime, Verg.
The "-i" means that the plural is in fact viri. The "n." means that it's neuter, which is weird since -us (singular) and -i (plural) are second declension masculine endings. If it's neuter, it ought to look like "virum" in the singular and "vira" in the plural. Perhaps it's a misprint in the dictionary and virus is in fact masculine, or perhaps t
This is an opportunity to get it right (Score:5, Insightful)
Isn't this a chance to do things right , rather than repeat the design oversights of the past?
Re:No, the internet was designed /w security in mi (Score:4, Insightful)
If it were designed with security in mind we wouldn't have to bolt - on such additions as SSL or certificates. These are meant to work around the problems that we face now.
Admittedly these wouldn't be such a problem on a purely military network , where every machine has a static IP and a known owner. But that's not the world we live in , is it ?
reliability and redundancy (Score:2)
Ref: UTexas [utexas.edu]
Q.
API (Score:5, Insightful)
keep them seperate from your applications. otherwise you have these silly problems.
Re:API (Score:2, Informative)
The only thing one prevents by locking out developers is a steady pace of progress.
Re:API (Score:4, Insightful)
So, no third party addressbooks/PIMs, no handy apps that prepend special *# network codes for roaming purposes (as used in some SIM toolkit applications for international roaming w/ prepaid phones), no apps that encrypt your phone conversation end-to-end using normal (not VOIP) connections so you don't need to use a data stream, etc..
Actually, that's exactly what the networks want! No third-party messing with calls, complete network services lock-in! So no worries there, then.
Re:API (Score:2)
I'd imagine encryption to be hardware based, since software ones would take up more cycles and power. and it has nothing to do with lockin. It doesn't prevent another company from transfering your # from one phone to the next, or hooking up some hardware to switch your current phone from one thing to the next.
Re:API (Score:1)
The use is allready there and expected to be there.. removing this feature for the most part would defeat the usability of your cell phones phone book. no-one wants to jot the number down so you could dial it when its allready in your cellphone.. The public wouldn't accept that feature disapearing.
Re:API (Score:1)
Re:API (Score:1)
Oops! I guess that only applies to Phones using a MS OS with "PhoneBook Explorer"
Re:API (Score:2)
Imagine if they didn't tie IE to the OS. It'd be a lot harder to get those stupid activex viruses, eh?
Re:API (Score:2)
You have got to be kidding. That's _ALL_ I want my phone to do.
Just let me control the software that deals with those APIs by explicitly installing it; instead of having the instant-message-chatroom-client that i never wanted install junk for me.
Re:API (Score:2)
costs (Score:5, Insightful)
If companies are held financially liable it will force them to do a better job of programming and testing software.
Re:costs (Score:5, Insightful)
Oh yeah, THAT'S a real good idea, all the phone companies have to do is suck up the charges to save face and then pass the bill onto their customers as a anti-spoofing tax or something like that.
If companies are held financially liable it will force them to do a better job of programming and testing software.
*Chortles* Right... [microsoft.com]
Re:costs (Score:1)
Re:costs (Score:4, Informative)
I couldn't agree more, there will always be someone around to circumvent or exploit exisiting code for their own purposes, be it good or evil. While I don't like playing the blame game with software companies and software, they should be liable for any damage their software (intentional or otherwise), especially if it interferes with emergency or mission critical systems. Of course, maybe I'm being too idealistic, or Polyanna as it were...
Re:costs (Score:2)
Well, in the end the average guy have to pay anyway, either by taxes or by the phone bill.
Re:costs (Score:3, Interesting)
*Chortles* Right... [microsoft.com]
When has Microsoft ever been held financially responsible for the damage its product caused?
Liability of the software maker is certainly a double-edged sword (think of Open Source contributors...). But don't you think if Microsoft were forced to pay some multi-billion dollar amounts for the damages caused by Blaster & Co., they would really start taking the wh
Re:costs (Score:2, Insightful)
I realize I'm sort of feeding a troll here, but everytime this sort of "Company A wrote buggy code" thing comes up, somebody starts harping for the company to have to be responsible for their code. Say Microsoft has to be financially responsible for the problems generated from their code - they'll just change the EULA to say "If this software kills your system or eats your children, it's no
Re:costs (Score:2)
Not if I didn't write the virus.
Re:costs (Score:2, Insightful)
Every Student in a univeristy that takes any sort of programming (Well any learning institution for that matter) should be taught Proper programming practices. That would include Exploits and how to write "Trustworthy" code.
When you look at the trend, Buffer/Stack overflows make up a massive majority of exploits. But since it is a well known prob
should be easy to fix (Score:2, Interesting)
Re:should be easy to fix (Score:1)
Sorry no links, just remember it! Tried Google but nothing other than noise (for my purpose anyway). Would welcome anyone posting a link they may have had bookmarked so I can refresh my memory.
Re:should be easy to fix (Score:2)
http://seclists.org/lists/bugtraq/2003/May/0076.h
The phone would lockup when sent a percent sign in the right part of an SMS message.
Re:should be easy to fix (Score:3, Funny)
Japanese #2: "I do not know. I don't read ASCII either."
Re:should be easy to fix (Score:4, Insightful)
This problem will get worse if the sandbox around the gaming/user run utilties is weak or unsecure.
It is also something that because devices are already out there would be difficult to prevent or fix. Perhaps requiring the Service provider automatically screening ALL txt messages with known exploits (This is also something the PC ISP's as a whole should do anyway, but thats a different subject).
More gadgets = more complication (Score:4, Interesting)
Re:More gadgets = more complication (Score:1)
Re:More gadgets = more complication (Score:3, Interesting)
I agree, I dont need a fucking phone that has everything, including the kitchen sink (although games are a plus
Re:More gadgets = more complication (Score:2, Funny)
You're just scared of technology you're not used to. Get over it.
today's dilbert addresses this issue (Score:5, Funny)
spam / calls / address book (Score:5, Insightful)
And I think phone viruses are becoming more and more possible through out the advances in phone technology.
Re:spam / calls / address book (Score:2)
Bound to happen (Score:5, Informative)
This is also a small part of the reason that the push was made for Java enabled phones, as there is less of a security risk (albeit still a small one) in running Java apps due to the construction of the language.
There is a somewhat heartening end to this story though. Sprint and other wireless carriers provision signed updates to phone firmware all the time over the air. Most times these updates include communications updates for new versions of software running in the MTSO or in the towers, but this sets a welcome precedent: Security updates can be pushed out to all phones of a particular model when they are first released. This way, a carrier will have no customers lingering months or years behind on updates (a la Windows XP and Windows Update) because the customers do not have to have the presence of mind to update manually, nor do they get to pick and choose what updates they want and what updates they don't.
Re:Bound to happen (Score:5, Insightful)
And how secure is that backdoor?
Re:Bound to happen (Score:5, Insightful)
My phone (Danger Hiptop) can recieve automatic over-the-air updates (it has already recieved two), but it is still secure as it only accepts signed code.
Re:Bound to happen (Score:2)
and the Microsoft XBox only accepts signed executables as well. too bad that some application saved-game code allowed full bypass of this.
the point is, even with DRM, there are going to be holes that can be exploited, whether it accepts only signed code or not.
Re:Bound to happen (Score:2)
How long before they start calling premium-rate? (Score:5, Insightful)
Re:How long before they start calling premium-rate (Score:2)
Hell, people have had their dial-up sessions hijacked because they were fooled into clicking something that disconnects them from their ISP and redials to an offshore number silently.
Re:How long before they start calling premium-rate (Score:2)
Re:How long before they start calling premium-rate (Score:2)
Monocultures (Score:5, Interesting)
As soon as there is a host that can be infected, in quantities of relative interest, viruses will evolve that can parasite it.
Mobile phones are safe only so long as they are too stupid to act as carries for self-reproducing code.
A good reason IMHO to spurn "smart" phones.
Re:Monocultures (Score:2)
Re:Monocultures (Score:3, Interesting)
Yes, a 2G mobile phone (especially GSMs) is very sophisticated, but it is not programmable in the way needed to propagate a virus. With a GSM, for instance, the worst you can do is send malformed SMS messages that smash the eprom. You cannot take control, in
Re:Monocultures (Score:3, Interesting)
Re:Monocultures (Score:2)
71% of e-mails sent to cell phones is spam (Score:5, Informative)
Looks like the state of the cell phone is getting close to the dire state of the net in Japan.
And the 3G revolution is now coming our way.
Be afraid. Be very afraid. Especially those with a pay-for-incoming-SMS/e-mails (or pay-for-received-data) scheme.
Re:71% of e-mails sent to cell phones is spam (Score:3, Interesting)
Re:71% of e-mails sent to cell phones is spam (Score:4, Insightful)
However we might have to really start worrying about this if a standardization of cell phones similar to the standardization of desktop computers happens.
As long as the standards remain different, cell phones aren't likely to be as affected as computers.
Why on earth would you pay for incoming calls? (Score:2)
Viruses? (Score:1, Redundant)
Re:Viruses? (Score:2)
No [reference.com]
The article is in English, not Latin
Re:Viruses? (Score:2)
I guess you missed the story from the other day with "virii" in the title... it turned in to a big silly discussion about the word and not the story. I guess the person who moderated me redundant missed it too. Or just saw my humour for the pathetic-ness it is (which should fit in fine here on
Re:Viruses? (Score:2)
Yeah, sorry, I did miss it.
But this is
Re:Viruses? (Score:2)
Re:Viruses? (Score:1)
The function of language is however to allow communication so if you understood what it meant then that function was successfully achieved.
Welcome to reality.
Now, correct me if I'm wrong but... (Score:3, Insightful)
The 3G phones are pretty much going to become the Windows of the cell phone world - Everyone is going to want one because it's pretty and does lots of things... but at a price.
How did they get this virus? (Score:5, Interesting)
Good news for Hollywood (Score:1, Interesting)
Great, Goatse on my cell phone? (Score:1, Funny)
Security flaw with MMS discovered - hackers can send you images anonymously and crash your phone!
My phone's gonna crash and the last thing that's going to happen is that I'm going to be Goatse'ed?!
Just Great! (Score:3, Interesting)
Now we will get virus's that will imitate commercials and everywhere you go there will cell phones saying, "Can you hear me now?" Of course the consumer will not have the know-how to remove a virus and their cell phone is to useful to drop in the trash can.
This also brings up...
"Can you hear me now? GOOD! *CLICK*
All I want... (Score:5, Insightful)
WTF does this have to do with a virus problem?
Oh, I know it. That lame ass crap I never used on my stupid phone... like games and worse crap they build into phones these days... are the reason.
Maybe if there wouldn't be the *STUPID* need for a fucking OPERATING SYSTEM that can play games and CRAP in your phone you wouldn't have problems with viruses?
As long asd we like to bloat simple things with shit, such stuff keeps happen!
Re:All I want... (Score:2, Insightful)
On the one hand I'm so tempted to agree. Simplicity is a wonderful dream.
But we forget that what is simple for you isn't for me and for a third is downright annoying.
For instance:
You want a phone that just makes calls. Your in luck, those are available.
I have a phone/pda combination. It has many many features I don't need or want. However it does keep good track of my schedule and remind me when I need to do things, meetings, calls, appointments, medication. For all practical purposes th
Re:All I want... (Score:2)
Get out of the US and go visit Japan, UK, Australia, etc and get a clue. Why was this modded Insightful anyway?
Obviously people want phones like this. The manufacturers are not telling people what they want - they are responding to what people want. In general, people are quite open to new technology. You just have to accept the fact the USA is the minority in the world mobile market and always has been, always will be.
Even the oldest of GSM phones have fairly complex multitasking operating system
Never got one (Score:4, Funny)
Cell phone viruses? Text-message spam? Never seen on- ... hold on, my phone just beeped ... looks like I've got 53 new text messages...
No, make that 67....
Bluetooth phones (Score:2, Informative)
Re:Bluetooth phones (Score:2)
This was predicted several years ago (Score:4, Insightful)
It looks like they've decided it'll be cheaper not to bother making them secure. Now, if there was a case for secure computing anywhere, it'd be phones.
This is a larger threat than it might first appear (Score:2)
Fast forward to cell phones and viruses; if an infectious DDOS sleeper trojan that targets cell phones appears, *Anything* which interoperates with the cell phone network can be hit. The article mentions 911 / 110 numbers, but it could be other cell phones, landlines, even sattelites.
I'd hate to see a directed,
In the Future... (Score:2, Funny)
Text messages? They're not the problem... (Score:4, Insightful)
The article isn't very clear about what is actually behind this problem. Over in the UK we've had text messaging (SMS, whatever you want to call it) for as long as I can remember - I was actually shocked to hear that most American mobile phone companies didn't use it. Anyway...
Point is, I don't think text messages are really the problem here. I've never heard of anything like this happening in text messages. A text message is a text message - a bunch of text. The cleverest thing I've ever seen done with text is being able to send messages that appear in flashing text, and even that only works on Nokia handsets. The only other remotely clever thing you can do with text messages is ASCII art, and we all know how clever that is.
I can imagine it being more of a problem when you get on to the idea of sending more sophisticated stuff, like video or more complex data. Hence I'm not surprised this has already been happening in Japan, as they are miles ahead of everyone on the mobile phone front.
The way I figure it, is there should be no means for a message to do anything remotely clever to your phone. In the same way that a properly set up mail client won't execute any old attachment, but merely present it to the user, a phone should present data or messages and have some means to keep them away from more sensitive parts of the phones software.
The way I see it, mobile phones have got too complicated for their own good. If you want a phone to make calls (remember the days when that was what a phone did?), then buy a phone. If you want to pick up your e-mail, send files to people, or surf the web, buy a PDA for pity's sake. At least the software for PDAs (Windows CE and it's more recent brethren) has been written with a decent knowledge of OS security in mind.
I knew it! (Score:5, Insightful)
[rant]
When you take a device that was originally designed to perform ONE function -- in this context, to be a good portable communications tool -- and you start loading it up with all kinds of useless bloat that is completely UNRELATED to being a communications tool, this is exactly the kind of crap you're going to run into.
Contrary to popular belief, not everyone thinks highly of downloadable ring tones, color screens, web access, gaming capability, or text messaging. I know, because I'm one of them. I would be perfectly happy with a simple, rugged, and RELIABLE mobile phone that was exactly that: A mobile phone, perhaps with the voice-activated calling feature, a good-sized speed dial directory, and the ability to snap into a fixed-mount handsfree cradle in the car.
The last thing I need is a ton of "features" that I don't want, don't need, and DON'T want to have to pay extra for just because they're present. Don't even get me started on the insane "Smaller is Better!" craze. It has served only to give us keypads that are so small that Tinkerbell would have problems with them.
[/rant]
Re:I knew it! (Score:2)
Well, I mostly agree with you, but I'm not as extreme in my beliefs.
I want my cell phone to make calls. Anything more is fluff...
On the other hand, having a unique ringtone makes it easier to tell who's phone is ringing (imagine being in a room full of people who own cellphones with the same ringtone, one person's phone rings, everybody has to check if it's their phone that's ringing).
I also like having games on my cell phone, because sometimes you're just stuck somewhere waiting for something
Spam Farmers (Score:2, Insightful)
Just one thing (Score:2)
Or not. My mainboard doesn't have a DRM chip...
Re:Just one thing (Score:2)
Just remember, in the Far East, *everything* is opposite, even if the reason seems to be "just because we can."
Re:...AV conspiracy (Score:1, Funny)
http://www.dilbert.com/comics/dilbert/archive/ima