Beware the new smartphone virus

NO ONE knows who lies behind Zeus. Security experts believe he or she is Russian, although no one is completely sure. But what they all agree is that Zeus is the most pernicious ''Trojan Horse'' on the internet. During the past four years it has infected millions of PCs, taking control of the computer and stealing personal banking details.
Microsoft has fought a running battle against Zeus, which is one of the most difficult types of malware to detect - but the great fear among cybercrime experts is no longer home computers. A new strain of Zeus, dubbed ''Zitmo'' (it stands for ''Zeus in the mobile'') has begun to exploit a huge hole in personal banking security: the smartphone in your pocket.
In the past fortnight, this malicious new version of Zeus, which attacks phones using the Android operating system, has sparked intense concern among security companies. One major US internet security provider, Trusteer, claimed Google Android is ''fraudsters' heaven''. Trusteer chief executive Mickey Boodaei said in a blog: ''Bad news: fraudsters have all the tools they need to effectively turn mobile malware into the biggest customer security problem we've ever seen.''

Advertisement: Story continues below

But it's not just Zeus that smartphone customers should be worrying about, according to Alex Fidgen of MWR InfoSecurity, one of the biggest cybercrime-busting outfits in Britain. It legally hacks into computers to test security. More recently it has turned its attention to smartphones and found that it can crack open every new handset it sees.
''The mobile phone industry is not fit for purpose, especially for financial transactions,'' says Fidgen. ''The evidence is irrefutable. You cannot be assured of security with modern smartphones. As soon as the handset is compromised, then any data is up for grabs.''
Fidgen says the fault lies with the handset manufacturers rather than the network providers or banks. In the race to bring new phones and new features to the market, many have left security low on the agenda. Modern smartphones, particularly when they are used in public Wi-Fi hot spots, can become fatally compromised. Trojans can enter a smartphone in many ways. All you have to do is click on a link or attachment that contains the virus, and within seconds it can secretly seize control. That link might be a TinyURL in Twitter. The attachment could be a vCard, the standard format for sending a business card to a phone.
Or it could be that you are accessing a website in a cafe. At Wi-Fi hot spots, fraudsters create bogus gateways, known as ''evil twins'', to which the latest mobile phones will automatically connect. Once a connection is established, all the information passing through the gateway can be read directly or decrypted, allowing fraudsters to harvest user names, passwords and messages. Until now, these attacks have been rare. But experts say that's just because smartphones are still taking off. ''We're walking into a minefield,'' says Fidgen, who has been warning about the risks for several months, ''but nobody's bloody listening.''
At Trusteer, Boodaei forecasts that ''within 12 to 24 months, more than one in 20 of all Android phones and iPads/iPhones could become infected by mobile malware''.
Are Apple iPhones safer than Android? MWR InfoSecurity says Apple's famed security from viruses doesn't quite translate to mobile devices. ''Both platforms have problems,'' says the company. ''The Android market has quite a reputation for serving malware regularly, whereas Apple seems to be in better control of the content of the App Store. Android, however, has Sandbox [a security feature], which limits the impact of malicious or vulnerable applications. This can help limit the effectiveness of the malware, a feature that does not exist on the Apple platform.''
BlackBerry phones are considered safer to use, as their maker, RIM, ''keeps details of the platform a secret, which makes it much harder for attackers to write malware''.
All the experts are agreed that ''jailbreaking'' - where you remove the limitations imposed by Apple on iPhones and iPads - exposes the user to much wider security threats.
Why not simply add an anti-virus program to your smartphone? The bad news is that the phones may have been built so poorly in the first place that the anti-virus programs won't be much help. All they do is give a false sense of security to users, say the experts.
Last week, a report in InformationWeek, a respected US technology magazine, warned of an ingenious new approach by Zeus/Zitmo that tricks home PC users into downloading it on to their smartphone. The Trojan sleeps on the home PC until the user logs into a bank website. At that point it wakes up, intercepts the process, asking the user to download a new security device on to their mobile phone to complete the banking log-in process. But in reality, the new security device is the Zeus Trojan infecting their phone. Once it's on, it takes control of the user's phone.
At the heart of Zeus is a Russian developer who produces the source code and then licenses the program to numerous fraudsters in the criminal underworld. This software genius regularly sends out patches and updates so that every time it is detected Zeus bounces back again.
Don Jackson of Dell's security arm, SecureWorks, is the person who first discovered Zeus, in 2007.
''Zitmo has all the hallmarks of the original author of Zeus. This brand new version is his flagship new product, which he's making available to a select few. He writes it, sells it for huge amounts of money, and even supports his 'customers' to rid it of any bugs that develop.''GUARDIAN

Read more: http://www.theage.com.au/technology/security/beware-the-new-smartphone-virus-20110729-1i47n.html#ixzz1TkaNtTDU