Antivirus for Smartphones?

Does My Smartphone Need Antivirus Software?

Smartphones can do many of things that computers do - even catch viruses and other malware. With millions of people storing sensitive personal information on smartphones and using them to check email, surf the Web, and conduct financial business, it's not surprising that bad guys are writing malware that targets phones.

One smartphone scam is an old one from the days of dialup modems, when hidden Trojan programs would secretly dial out to $5-a-minute sex chat lines. Security researcher Dinesh Venkatesani has documented a rising number of Java-based "p**n dialers" finding their way onto smartphones. Such a program, unbeknown to the user, can send SMS messages to premium-priced services. The owner of the smartphone gets a very big surprise in his or her next phone bill.

Smartphones can also be enslaved by cellular botnets - networks of compromised phones which, upon a command from a central slavemaster, can launch a distributed-denial-of-service attack to overwhelm a cellular carrier's network with bogus traffic. Such DDoS attacks are pretty common on the Web, where enslaved computers are used to bombard a Web site with so much traffic that it crashes.

Malware can find its way onto smartphones through the same vectors by which it infiltrates computers, and others. Opening an email attachment; clicking on the wrong Web link; or downloading what's advertised as a ringtone can infect a smartphone with malware. With so many software apps available for smartphones, and so many people blithely downloading them, smartphones have become very fertile ground for malware writers.

The corporate world has been concerned about mobile device security almost since the beginning of the PDA and smartphone industry. Consumers are just now beginning to wake up to the threat posed by mobile malware. Fortunately, the same anti-malware tools used by enterprise IT managers to protect their "fleets" of mobile devices also work on consumer smartphones.

Kaspersky Mobile Security 7 is a top-rated security suite for Symbian OS mobile phones. It blocks unwanted SMS and adware messages; keeps your phone free of malicious software; and prevents your PC from becoming infected when syncing with your mobile phone. It even helps to protect your critical data if your phone is lost or stolen; you can remotely lock or delete files on a missing phone. If your SIM card is replaced, Kaspersky Mobile will notify you of the stolen phone's new number so it can be tracked down.

SMobile Systems offers security products which works on Windows Mobile, Blackberry, and Symbian-based phones. It provides automatic real-time protection against viruses, Trojans, and other malware. Its anti-theft protection includes GPS location of a stolen phone. It can automatically scan memory cards when they are inserted and prevent any malware on a card from infecting your phone. The "parental controls" feature allows remote backup of all data stored on the phone, so even if it's lost or stolen you can recover important information.

Do You Need Anti-Virus Protection For iPhone?

The iPhone runs a modified version of OS X, which is believed to be very secure. In addition, iPhone apps run in a "sandbox" environment which prevents them from interacting with other apps, or accessing any data outside the sandbox. But it turns out they're not immune to hackers either. iPhones that have been jailbroken (modified to run unauthorized software) have been found to be vulnerable to various malware attacks. Ikee, the first known iPhone virus, only changed the wallpaper on iPhone desktop. But other malicious attacks have followed, with the ability to steal passwords, your email, photos and calendar, even send text messages and make calls.

Even though there have been no reports of viruses affecting non-jailbroken iPhones, anti-virus vendor AVG went on the record in mid-2009 that they are working on an anti-virus product for the iPhone. The biggest hurdle is that iPhone doesn't allow applications to run in the background, which is something that a security tool would need in order to provide real-time protection. Critics claim that's exactly why the iPhone doesn't need anti-virus software. But Apple recently announced that multi-tasking will be a key feature of the iPhone 4.0 which is due in summer 2010. We'll have to wait and see if this poses a new security risk, or if other iPhone attack vectors will be discovered.

What About Android Phones?

The most common answer I see to this question is that "The Android operating system is a variant of Linux, which cannot get a virus." Of course it's NOT true that Linux-based devices are immune to viruses and malware. There are a lot less viruses that affect Linux, but that's primarily because virus writers focus on Windows, which is 90% of the computing market. So I think it's fair to question whether Android devices might need anti-virus protection. Especially so, since Google's Android Marketplace is much less restrictive than Apple's App Store about what can be made available for download. A few malicious apps have appeared on the Marketplace, posing as online banking tools. These fall more into the category of phishing, since they don't contain code that can cause damage to the Android OS or other apps.

Another important point is that when you install an Android app, the system will tell you which system services the app wants to use or access. For example, an app may request permission to access your calendar or the Internet, send/receive text messages, or initiate a phone call. If you have any doubts about the permissions, don't install the app. And don't be the first person to install any app. Look for apps with lots of positive user comments and good ratings.

There have been some credible reports of a few HTC Android phones being shipped with a virus on the SD card, which could infect Windows PCs when connected by USB. But it's important to note that's not really an Android virus, but rather a PC virus that happened to be lurking on an Android memory card.

I do think it's entirely possible that a malicious app might someday appear in the Marketplace, or that someone will find a hole in the browser security that could compromise an Android phone. But I don't see any evidence that it has happened yet. Nonetheless, you can find security software for your Android phone. PhoneGuard promises to defend against viruses, spyware, malware and emerging threats that target Android devices.

Bottom line, I don't think it's time to run out and buy anti-virus protection for the smartphones widely available today. Yet. But with millions of new smartphones flooding the market, you can bet that Evil Hackers will be looking for any crack in the defenses. And it wouldn't surprise me if I read tomorrow that a horrible virus was infecting iPhones, Blackberry or Android phones.

For now, I recommend exercising caution when installing apps, and be careful where you go on the Web. You can also check the website of your phone's manufacturer, and your cellular service carrier, to see if they recommend anti-virus software for your specific phone.

Do you have something to say about antivirus for smartphones? Post your comment or question below...