Time to tackle mobile malware before history repeats itself

Stuart Corner
Tuesday, 03 July 2007 16:55

Your IT - Mobility

F-Secure senior security specialist, Patrik Runald says the industry needs to learn from the history of PC malware to counter mobile malware while it is still in its infancy.

F-Secure's latest Internet and mobile security review painted a gloomy picture of online criminals able to generate ample funds from their exploits to invest in ever more sophisticated tools with which to perpetrate their crimes.

"The reason we want to highlight the mobile threat is that if we had taken the PC threat seriously 10-15 years ago we would have been in a lot better position than we are now," Runald told iTWire. "We could have had more secure operating systems, email could have been made more secure: I should not have been so easy to fake email addresses. There are lots of things that could have been done and we are now trying to catch up. There are now 350,000 pieces of malware for PCs."

However, it is easy to have 20-20 hindsight and Runald admits that even F-Secure, which has been in the security game since 1988 underestimated the danger. "We were in the business and we took it seriously, but even we did not think [malware] was going to be this bad."

Runald argues that the mobile malware 'industry' is at about the same stage of maturity as the PC malware 'industry' a decade ago. "By and large the people behind mobile malware are the people who were behind PC malware eight years ago; kids doing it for fun...[But] we are seeing the same evolution path."

Runald expects the evolution of mobile malware to follow that of PC malware but with a greatly compressed timescale. "A few weeks ago we had the three year anniversary of the first mobile virus and in 2006 we had the 20th anniversary of PC viruses....Now we already have the first spyware for mobile phones. We have seen the first MMS viruses...Everybody knows that smartphones will outgrow PCs very soon and everyone sees that smartphones are becoming miniature PCs. A lot of these will be online all the time in a few years. So if the bad guys want to create botnets from mobile phones then, why not?"