Panel: Open phones are more vulnerable

The opening up of mobile software platforms will lead to more dangers, security executives said.

The opening up of the mobile industry is great news for application developers but not so good for IT security professionals who want to sleep at night, executives from the security industry said Thursday.

Mobile phone operating systems have been highly fragmented and carriers have tightly controlled the applications that can easily be used on phones, but that approach is giving way to open-software platforms and easy-to-use application stores. In addition to Apple's recently introduced iPhone SDK (software development kit), Google's open-source Android platform is due on phones soon and an open-source version of Symbian is on the way.

"Everyone has now decided that the developers are very important for the future of this business. If a developer can load software on a device, a hacker can load software on a device," said Mark Kominsky, CEO of Bluefire Security Technologies, during a panel discussion at the CTIA Wireless I.T. & Entertainment show in San Francisco. "I think we're probably 12 to 18 months away from something big happening," he added.

Mobile devices are beginning to have high bandwidth, open platforms and the ability to load new software, Kominsky said. "Those are the critical elements that occurred in the notebook when viruses took off about 20 years ago," he said.

Symbian, the single most widely used mobile software platform, has already wrestled with the dangers of openness to third-party developers, said Khoi Nguyen, group product manager in mobile security at Symantec. Symbian 7 and 8 were fairly open and allowed almost any application to be installed and run. This led to a few hundred viruses being introduced within a couple of years, so Symbian 9 was locked down significantly, he said.

That made it much harder and more expensive to develop applications for the OS, even for a big company such as Symantec, Nguyen said.

Symbian and other platform vendors will have to find a balance between security and openness, he said.

By the same token, the fragmentation of the mobile world that has hobbled software developers still insulates phones from the onslaught of attacks on PCs.

Symbian has less than 70 percent of the market, Nguyen said. "It makes it very hard for a hacker to develop a single threat ... that can run on all these different platforms," he said.

Nevertheless, there are some new types of malware for enterprises to look out for, as well.

"Snoopware" is a form of spyware that can activate the microphone or camera without the user's knowledge, listen in on calls and collect text messages and call logs. Another type of threat, which he called "pranking4profit," can trick the user into allowing actions that will cost money. In one case, a hacker advertised a free Web browser for Symbian phones and convinced many users to download code that caused their phones to send thousands of premium SMS (Short Message Service) messages to a hacker's phone. Each one cost the sender US$2 or so, Nguyen said.

Although malware may make headlines, the greatest danger to enterprises with mobile phones is loss or theft of data, the panelists agreed.

Enterprises should protect their employees' mobile phones just as they do any other end point, with the same security policies and requirements as well as security software, with an eye to compliance as well, Nguyen said. Companies should also maintain an inventory of their mobile devices and regularly push out software updates. To protect data, they should use password protection, encryption of data and remote data wipe capability, he said.

They should also disable features not required for business use, he said.

2015 State of The IT Channel Survey : IT'S TIME!!! Fill in this year's State of the IT Channel Survey and be in the running to win great prizes. CLICK HERE

Join the ARN newsletter!

Error: Please check your email address.

Tags mobile applications

More about AMPAppleCTIAGoogleSymantecSymbian

ARN Directory | Distributors relevant to this article

ARN Directory | Vendors relevant to this article

Show Comments
 

Latest News

03:39PM
Cirrus Networks signs $4.6 million in contracts via new strategy
03:10PM
Alcidion raises $1.5 million to expand Miya decision support platform
11:34AM
Samsung Galaxy S6, S6 Edge: On sale in Australia, April 10, from $999
02:16PM
Invigor uses Big Data to slice prices for consumers
More News
21 Apr
APJ Progress Spark Conference
22 Apr
2015 Innotribe Startup Challenge
27 Apr
Disruptocon
27 Apr
Disruptocon
View all events