Subject: [NEXTEL-1] Rx For Handheld Virus Threat: Prevention

From: [email-masked]
Date: Fri, 03 Oct 2003 15:14:53 -0400

Rx For Handheld Virus Threat: Prevention
So far, handheld-specific viruses have not created a big problem, but security
software developers say the threat of malicious attacks increases as new
applications are developed.

OCTOBER 1, 2003

On the heels of one of the worst computer virus episodes in memory, with the
Blaster and SoBig viruses wreaking havoc across countless corporate networks,
Symantec Corp. released anti-virus software programs for handhelds and PDAs
running Palm Inc.'s Palm OS and Microsoft Corp's Pocket PC operating system.

McAfee and Trend Micro each have handheld/PDA anti-virus software on the
market, and Symantec previously released anti-virus software solely for Palm.
But of all the virus horror stories recounted by frazzled IT managers during a
virus-heavy August, none involved handhelds, thus begging the question, is the
virus threat to handhelds real or imagined?

"Right this minute, it's largely irrelevant," says Dale Gonzales, chief technology

officer for mobile applications provider Air2Web Inc. "The [virus] threat activity

has remained low," admits Laura Garcia-Manrique, group product manager for
Symantec. "But the concern is high."

That concern appears to be largely a future, but some believe inevitable,
consideration.

"It's only a matter of time before the writers of viruses view [the handheld
platform] as an interesting area as [device] numbers grow," says John Muir, vice
president of corporate development for Pointsec Mobile Technologies Inc., a
developer of enterprise security services for mobile devices.

Since the emergence of the Phage virus three years ago, which targeted Palm
handhelds, only a few others–the LibertyCrack Trojan Horse, Vapor and the Palm
MTX virus–have appeared, doing little damage. No other handheld-specific
viruses have been discovered, according to Garcia-Manrique, and none since
2001.

But since the first handheld viruses appeared, the market has changed. In
December 2002, Palm announced it had sold more than 20 million handhelds,
reaching the magical "critical mass" threshold, "clearly changing the impact a
threat can have on a given platform," Garcia-Manrique says. And the
Palm/Pocket PC platforms, she says, remain largely unprotected.

Additionally, because more handhelds are now capable of wireless connectivity,
the handheld platform "is becoming a connected platform," Garcia-Manrique
says. "This changes the game. The door is open [to enterprise networks] for
information to flow to devices with malicious code."

While many known worms and computer viruses exploit e-mail programs, using
attachments that must be opened to activate an "executable" file, none of these
have the ability to operate on Palm or Pocket PC devices because most handheld
e-mail programs and operating systems are not capable of launching an
executable file, Gonzalez says. "If you don't have an executable environment,
you can't create a virus."

As new applications for wireless connectivity and devices are developed, "that's
where the holes will show up that viruses will take advantage of," says David
Perry, global director of education for security software developer Trend Micro.
When that threat develops, he says, the company is poised to go to market with
software, like its PC-cillin for Wireless, to address viruses.

"All of this is reasonably far out," in the future, Gonzalez says, "but the virus
people are doing the right thing by prepping for it." It's also useful, he notes,
for
enterprises to start considering handhelds when conducting security risk
assessments to determine the value of data residing on the devices.

As handhelds increasingly show up in enterprise environments, they represent
another "endpoint" in networks that should be protected, just as desktop and
laptop computers are often equipped with firewalls, anti-virus, user
authentication
and encryption software. "That set of services will become mandatory," especially
for organizations in the financial services, health care and government sectors
that generate sensitive data, Muir says.

Yet Muir acknowledges that anti-virus software, separately from other security
features, might not be cost-justified given the current risk. The biggest security

threat, he says, is still lost or stolen handhelds/PDAs.

http://www.wirelessweek.com/index.asp?layout=article&articleid=CA326383&spacedesc=Departments&stt=000

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Buy Ink Cartridges or Refill Kits for your HP, Epson, Canon or Lexmark
Printer at MyInks.com. Free s/h on orders $50 or more to the US & Canada.
http://www.c1tracking.com/l.asp?cid=5511
http://us.click.yahoo.com/mOAaAA/3exGAA/qnsNAA/61FxlB/TM
---------------------------------------------------------------------~->

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/