Hackers focus on targeting smartphones

At the World Athletics Championships in Helsinki this year, athletes and spectators were invited to download an application that would show event results on their mobiles. But a hacker exploited a security loophole in smartphones to deliver a virus over the Bluetooth radio network. So many people were infected that the authorities had to set up a special booth to remove the virus from their handsets.

Telecoms companies and business users alike are waking up to a new threat. The security industry had been sceptical about mobile viruses; although a number of researchers had demonstrated they were possible only a handful of smartphone users had been affected. Risto Siilasmaa, the chief executive of F-Secure, a Finnish computer security company, says the threat to mobile phones is growing more rapidly than PC viruses did in the 1990s. At the EU-backed ISSE (Information Security Solutions Europe) conference in Budapest earlier this month, he outlined the scale of the problem: "Mobile viruses have been found in 30 countries. Operators have had to block multimedia messaging traffic, and 3.5 per cent of MMS traffic is already 'malware' [programs designed to cause harm]."

Although smartphones - mobile handsets that run the Microsoft, Linux, Symbian or Palm operating systems - account for just five per cent of the worldwide mobile market, that is still a huge number of users when you consider there are two billion handsets in use.

And the people who buy smartphones tend to be the very ones who rely heavily on them for communications and are likely to send and store sensitive information. This includes technophiles, self-employed professionals, corporate executives and government officials.

Siilasmaa points out that 55 mobile viruses are known - a tiny number set against the 145,000 or so recorded viruses, Trojans and other malware that affect PC users. But a year ago there were no recorded mobile viruses outside the labs. The PC versions, he adds, did not spread that quickly.

Some observers dismiss the threat, suggesting that some anti-virus and security companies are snake-oil merchants. Even computer security firms are divided on the scale of the problem.

John Thompson, the chief executive of Symantec, the world market leader in anti-virus technology, is cautious. The spread of malware on portable devices is inhibited by the plethora of incompatible operating systems, he explains. One reason so many people, amateur hackers and hardened criminals alike, target Windows PCs is their sheer ubiquity.

"We see more than 100 new PC viruses a week," says Thompson. "I can't get excited by 55 mobile viruses. We have software that runs on Symbian and [Microsoft] PocketPC and Palm, but 55 viruses does not make for an economic motive [to distribute that software] yet."

Thompson points out that most mobile viruses, such as the outbreak in Helsinki, spread using short-range Bluetooth radio connections. This makes large groups of people in small spaces - sporting venues, conferences or concerts - the most vulnerable. Symantec is confident it has the software to block these viruses.

The onus, it seems, is on technology users to protect themselves. Anti-virus software for a smartphone might not be perfect but it is relatively cheap.

As for peer-to-peer Bluetooth viruses conference delegates and sports fans should heed the advice of Elsa Lion from technology consultancy Ovum. "It is fairly easy to stop Bluetooth-based malware," she says. "Just turn off the Bluetooth radio in your phone."

- INDEPENDENT