Computer viruses seek out your cell phone

As cell phones get smarter, they also become a target for malicious code. Here's how to protect yourself.
When it comes to cell phones, the smarter they are, the harder they fall - for viruses.

Almost one in four cell phones sold in the U.S. are now smartphones, according to FTN Midwest Securities - do-it-all wireless devices that can handle voice calls, e-mail, office documents, and more.

But these increasingly capable devices are also increasingly vulnerable to mobile viruses. The same computer-like features that make smartphones appealing - an operating system that makes it easy to add new software programs, increased storage, and more powerful processors - also make them a target for hackers.

"Mobile viruses will probably get worse," says Shane Coursen, a senior technology consultant at antivirus software firm Kaspersky Lab. "In the history of computer viruses, as a platform becomes more accepted and more widely used, there are bad guys out there waiting to take advantage of it."

Dialing up danger

This isn't a theoretical threat. The first mobile virus, Cabir, originated in the Czech Republic two years ago and has since spread to 25 countries.

Just last week, F-Secure, a Finnish security research and software firm, published information about Commwarrior.Q, a virus that can infect smartphones running the Symbian Series 60 operating system, which is found chiefly on dozens of high-end Nokia (Charts) models. (Symbian is a company owned by a consortium of cell-phone manufacturers.) Symbian's operating system is particularly popular with virus writers because of its wide use, especially in Europe and Asia.

Microsoft (Charts) Windows Mobile, the operating system found in Motorola's (Charts) Q and Palm's (Charts) Treo 700w smartphone, is also vulnerable to viruses.

To be sure, the mobile virus problem is incredibly small compared to the PC virus threat. Tech research firm Gartner says it doesn't expect the first mass mobile-virus outbreak until the end of next year, at the earliest. Experts believe there are about 200 mobile viruses known to have spread from phone to phone; by contrast, there are hundreds of thousands of PC viruses.

And viruses typically only spread between phones using the same operating system. The basic mechanism is the same as PC viruses -- a bit of code has to be transmitted from one phone to another.

But unlike with PCs, where the ubiquity of Microsoft Windows makes it easy to write viruses that can spread from machine to machine, cell phones use a variety of operating systems: Linux, PalmOS, Symbian, Windows Mobile, and Research In Motion's (Charts) BlackBerry software. A virus written for one OS generally won't work on a different one.

A personal attack

The threat to phones takes on unique dimensions because we carry them with us all day long and they're continuously connected to networks, says Paul Miller, managing director for mobile and wireless security at Symantec, the security software maker.

"You identify with a cell phone much more than you do with a PC," says Miller.

And while PC viruses these days typically use e-mail or Web downloads as a way to infect other computers, mobile viruses have more ways to attack. Mobile viruses can use those mechanisms, but they can also use short-range Bluetooth wireless connections, text messages, and memory cards to transmit infected files.

According to Miller, Bluetooth is a common means for viruses to spread, since physical proximity is all it takes for a virus to jump from phone to phone.

"Infections follow a biological pattern," says Miller, describing an actual mobile-virus outbreak Symantec researchers studied. "They hopped from population center to population center like the common cold.

Miller points out that smartphones are also increasingly attractive targets for hackers looking to steal corporate data. Like laptops, smartphones can now carry important information like a salesperson's contact lists or an executive's PowerPoint presentations. A recent Symantec (Charts) survey found that 55 percent of smartphone users store confidential personal or business data on their devices. A virus could easily be programmed to use a phone's wireless connection to send such files to a hacker's email.

Seeking protection

There are some simple steps that smartphone users can take to lessen the risk of infection, says Kaspersky Lab's Coursen.

First, if your phone has Bluetooth and you're not using it with a wireless headset or other Bluetooth device, turn the Bluetooth off. If you do need to use Bluetooth, set it to "nondiscoverable," which means your device won't actively broadcast the fact that it's accepting Bluetooth connections, which is an open invitation to virus-infected phones.

Second, if there's antivirus software available for your phone, download it and install it. Nokia preinstalls Symantec's mobile antivirus software on some phones, and both Kaspersky Lab and Symantec, among other antivirus-software makers, offer software for a wide range of models.

Lastly, accept files sent to your phone through email or text messages with extreme caution. "You want to be sure when you accept a file that you know who's sending it," says Coursen. Even then, since viruses can exploit phone address books to send infected files to a victim's contacts, be careful accepting unexpected files even from people you know.

Granted, Coursen and Miller have a vested interest in pushing more antivirus software. But if PC viruses have taught us anything, it's better to be safe than sorry. As smartphones proliferate, any failure to protect them seems just plain dumb.