Proof of Concept PocketPC Virus Created

SpooForBrains writes "The Register has reported that "Ratter" of the virus writing group 29A has created the world's first PocketPC virus as a proof of concept. This one has no payload and is polite enough to ask if it can spread, so the dangers are minimal, but it occurs that the possibility of PocketPC and Symbian virii suddenly makes the concept of bluejacking somewhat more sinister."

Reminds me of that windows virus...

[nmoog]

Do you accept the microsoft EULA?

Re:Reminds me of that windows virus...

[strictnein]

29A in hex = 666 in dec

CRAZY!

E-Darwin

[Cavio]

Just like biological ecosystems, our information infrastructure has niches, and viral "life" will thrive in any niche it can find for itself. Same with spammers, they are exploiting a niche which exists to make money. Virus writers are exploiting computing niches which allow for this kind of attack.

It is inevitable that any networked system will suffer from these attacks. See the recent Mozilla shell exploits. We have Linux security issues, and as the OS gains popularity, we will start to see virii for it. It will happen.

We have basically created electronic primordial soup. Three cheers for compu-evolution!

Re:E-Darwin

[Ieshan]

Comparison:

a) There are sadistic people who like to cause people harm by investing time and money into writing virii that inconvenience, destroy data, and render devices useless - meaning to do ALL of these things ON PURPOSE.
b) Viruses evolve.

The fact is, there's no little Virus overlord someplace up in the sky that's trying to cause damage and harm to humans. There *are* lots of other humans who love causing that same damage by writing malicious code.

If everyone decided tomorrow to stop trying to break the machines that others have worked so hard to build, voila - they'd not be broken anymore.

Sadism / Sociopathy has little to do with the Biological Evolution of Viruses. What gives? Why are people so quick to assume that it's okay for people to break things and hurt people just because it's possible to do so?

Re:E-Darwin

[BigBir3d]

And if people were not writing the viruses for various computer and related platforms, I think the evolution of these platforms would be at a slower pace. It is of no suprise to most people that there are other people out there wanting to test the limits of what can be done.

Re:E-Darwin

[cduffy]

So? Yes, the growth medium is humans motivated by challenge, or maliciousness, or *whatever* -- but if you take it as a given that somesuch growth medium exists, computer virii behave in several biological ways.

They combine their "genes" as folks splice the new, most effective payloads and mechanisms together; they mutate whenever someone comes up with a new and previously nonexistant technique... etc.

In short -- just because they're made by folks whom society would, generally speaking, be better without

Re:E-Darwin

[FooAtWFU]

I thought the major point of a virus wasn't to cause damage and harm to humans and evil stuff like that... the point of viruses is to make the machine your zombie and send spam.

Oh, wait. Yeah, I guess you're right. Never mind.

Re:E-Darwin

[Dr. Evil]

It's not o.k., it's inevitable.

It's also inevitable that somebody is going to try to stop them.

But it is foolish for those people who're trying to stop them to think that they can actually succeed.

You can greatly reduce the likelyhood of somebody authoring viruses with strong detection and deterrants, but that generally has side effects which are worse than the problem.

Viruses are a technical problem, I think they can be solved, they might take a new philosophy in software design, but wrapping up so

Re:E-Darwin

[meringuoid]

The fact is, there's no little Virus overlord someplace up in the sky that's trying to cause damage and harm to humans.

Another Slashdot evolutionist... there is a Virus Overlord up in the sky trying to cause damage and harm to humans! And he does it because he LOVES you! Why do you keep making him have to hurt you?

Re:

[account_deleted]

Comment removed based on user account deletion

Re:E-Darwin

[severoon]

I disagree with you wholeheartedly. While I have better things to do than write viruses, I think the people that do it contribute to software in an unignorable, public way. They exercise complex systems in ways that companies themselves would otherwise refuse. As we become more and more advanced as a society, our software systems take control over more and more elements of our daily lives.

The catchword for this discussion is: robustness. We absolutely need our systems to be robust if we're going to depen

Re:E-Darwin

[nzhavok]

severoon, what you have done, whether you know it or not, is present a classic straw-man argument.

Ieshan argues "If everyone decided tomorrow to stop trying to break the machines that others have worked so hard to build, voila - they'd not be broken anymore." This is mostly correct (except for software bugs that break the machines), you do not address that in your post. Ieshan also says "Why are people so quick to assume that it's okay for people to break things and hurt people just because it's possible

Re:E-Darwin

[Anonymous Coward]

i really cant wait to start seeing viruses for linux maybe then all you zealots will shut the hell up about MS. As Cavio stated "Linux has security issues" and with security issues and an expanded user base you are bound to get viruses running around, sooner or later it will happen, and it wont matter if there is a patch out within 24 hours of a virus release most people won't patch there computers, most of the problems with computers come from there users. But keeping bitching and moaning about MS one da

Re:E-Darwin - Optimist?

[lcsjk]

I take it you're not and optimist!

Re:E-Darwin

[Anonymous Coward]

and with security issues and an expanded user base you are bound to get viruses running around,

You know I keep hearing this..."The only reason that Linux doesn't have as many exploits ...bla bla bla It does not work that way. If that were true shouldn't the worlds most common web server (Apache) have the most vulnerabilities?

Re:E-Darwin

[severoon]

The problem for would-be virus-writers on the Linux platform is that there is more ego-weight on the side of fixing and protecting Linux than on the side of embarrassing that platform and bringing it down. Besides, Linux users are by definition more intimately knowledgable about their computers and more likely to keep up with news, patches, updates, etc.

Viruses are an ego-based affair. There is more interest in protecting Linux than harming it, so any virus that comes out would probably find that the sec

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:E-Darwin

[GlassUser]

2. Windows is built with a major security flaw in as much as certain core system applications always have full access to the system. Therefore, if a virus attacks via an application, it can get system-wide permissions. On a poorly administered Linux system, this can also happen but the tendency now is to run applications at a user account level, rather than at root level. Most users are also educated enough not to run constantly as root. Therefore, assuming that you are running a common application version

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:E-Darwin

[GlassUser]

I accept that but would argue that a Windows system comes "out of the box" poorly configured for security.
Only has poor as you make it. Of course there's going to be a single default admin account on a fresh system. Just like root on *nix. When you need a user, just add them. There are all sorts of flashy wizards for users that can't grasp "net user username password /add".

Also, take a script on UNIX/Linux and it's permissions are determined purely by the user who ran it, hopefully not root - theref

Re:E-Darwin

[drinkypoo]

I accept that but would argue that a Windows system comes "out of the box" poorly configured for security.

But this is true of most Unix systems as well. They have services running which have had vulnerabilities in the past (like Sun's RPC server, for example, it's only only Microsoft that's been hit with that one) and they do not typically firewall by default.

Re:

[account_deleted]

Comment removed based on user account deletion

Re:E-Darwin

[severoon]

Part of what makes this discussion so difficult is that these two OSes are undoubtedly aimed at (or at least enjoyed by) different target audiences. Linux/UNIX users can justifiably argue that these OSes come "out of the box" poorly configured for security, but that's fine. Windows users can hardly make the same argument given the type of user that OS is aimed at (this is not a slam, it's just a simple statement of fact that my Grammy-maw isn't going to use Linux anytime soon).

What if iMacs were delivere

Re:E-Darwin

[Sepper]

This is blatant FUD.

It is, but there is an once of truth in it. The default behavior.

By default, Windows Xp Home runs me as admin, and I had remove permissions for it the be secure...

By default, Mandrake runs me as user. I had to learn to change to root.

But I think the best behavior is with OS X (which I don't own). It prompt you with a password windows each time you need admin access. To me the says: 'STOP! think about what you are doing! Are you sure, you know what you are doing?'

Kinda like the way my sister caught Sircam.exe but when the thing poped-up in ZoneAlarm, she got the reflex to click 'No': "I don't know this application, And everything seems to work OK without it, so there...". She was infested all right, but it didn't spread... (and didn't clog her dial-up line). And off, I did have the "AAAHH! VIRUS!" Reaction when I saw the same pop-up on her computer... Now she google for the file when she don't know... I'm soo proud of my sister, growing up before my very eyes *snif*

Education, can go a long way, but if people can't know they have problems, we can't help them... Default install would go even further... If would force so people to think...

Windows isn't the problem, Ignorance is the problem. Education is the solution.

Re:E-Darwin

[SpooForBrains]

But I think the best behavior is with OS X (which I don't own). It prompt you with a password windows each time you need admin access.

KDE also does this.

Re:E-Darwin

[16K Ram Pack]

There's some other reasons...

Open source code allows for more scrutiny. Not just in the exact details of the code, but in terms of overall approach.

It's not a monoculture. If an approach by one app or service seems to give security issues, maybe people will approach it from another route. Also, because it's not a monoculture, people can come up with alternative solutions, and let the market evolve to choose the best one.

"Binding" does not occur, so applications work as applications, not as part of the op

Re:E-Darwin

[danielpavel]

4. The average Linux user is far more Internet-savvy than the average Windows user - and that's not, in any way, devaluing some of the very knowledgeable Windows people that I do work with, for example - but average Joe Bloke at home runs Windows & only tries Linux when he starts to feel like he knows a little more about how PCs and networks actually work.

True -- Linux's current barrier-of-entry is rather high. But for Joe Bloke to run Linux at home, Linux will have to lower at Joe's level. That m

Re:E-Darwin

[Sloppy]

See the recent Mozilla shell exploits.

...which were on the Windows version of Mozilla only. Yes, it was a Mozilla problem but the architecture of Windows allowed the hole to be exploited.

Don't kid yourself. This was very much an error in the Mozilla team's way of thinking. The insecure interface that Windows had, never should have been exposed to the Internet. Normally, it wouldn't be exposed. That Mozilla exposed this interface, shows, IMHO, some carelessness and low standards of paranoia, on their part.

Linux also has APIs for use by local users, that probably should not be callable by just anyone on the internet. The recent exploit on Windows Mozilla has reduced my confidence that Linux Mozilla is not exposing internal APIs.

Mozilla is a big complex app, and I'm not sure I trust it anymore. (I sure as hell haven't audited it. Have you?) I'm starting to think I need to either stop using it, or somehow sandbox it.

Re:E-Darwin

[linuxci]

Don't kid yourself. This was very much an error in the Mozilla team's way of thinking. The insecure interface that Windows had, never should have been exposed to the Internet.

Wrong! It was a protocol, and the way an application is meant to handle unknown protocol schemes is to pass them to windows. That's why mms:// links open media player under windows.

Therefore it was upto Microsoft to ensure any protocol accessible to applications was safe to use on the internet. Why else would it have been implemente

No danger yet.

[vi (editor)]

For spreading viruses need a sufficiently high density of potential victims. So your PoketPC is safe. The story is completely different if someone get this done on cell phones.

Re:No danger yet.

[mischalla]

Quote from the article: "...The same group created a virus capable of infecting mobile phones running the Symbian OS, called Cabir, in June. Cabir - like Duts - was a proof-of-concept exercise..."

Can it really spread?

[yohanes]

Unless there is a flaw on the implementation of the phone can this kind of virus really spreads?

Not phones, not big news (but here's a link anway)

[LondonLawyer]

Unless there is a flaw on the implementation of the phone can this kind of virus really spreads?

It's not a phone virus, it's a Pocket PC virus.

From the article:

The first computer virus to infect handheld devices running Microsoft's PocketPC OS was discovered over the weekend... Cabir - like Duts - was a proof-of-concept exercise. In both instances, 29A sent its malicious code straight to anti-virus firms.

To my mind, the word "discovered" doesn't really apply here.

Previous attempts have been m

Re:Can it really spread?

[antin]

Don't most virii just exploit flaws in something or other? I suppose it depends on your definition of virus - but these days it seems all the internet worms spread through security holes. So yeah, perhaps a perfect phone would be immune, but it is desinged by humans afterall... and a large team at that no doubt.

It *asks* if it can spread?

[Ieshan]

Proof of Concept Amish Virus!

You have been infected. This virus works on the honor system. Please delete all files on your computer. Thank you.

Amish computer ??

[Fred_A]

Shouldn't that be "please shred all files in your desk drawer" ?

Re:

[account_deleted]

Comment removed based on user account deletion

Re:Amish computer ??

[doublem]

No, it should be "Please feed all the files in your desk drawer to your sheep."

Re:It *asks* if it can spread?

[ssbljk]

well, that concept has bug
it should be written "enemies" instead of "friends"

How many times?

[Anonymous Coward]

How many times does it need to be said that the plural of "virus" is "viruses", not "virii"??

Re:How many times?

[Anonymous Coward]

manyii.

Re:How many times?

[Anonymous Coward]

How many times does it need to be said that no one realy cares?

Re:How many times?

[chegosaurus]

(Note for those with a tendancy to take everything literally: the "you" in this post is general - it doesn't refer specifically to the parent poster. It is also meant for those who speak English as their first language.)

You call yourselves geeks, you chew people out for the smallest technical error in a linux thread, you go apeshit if someone refers to "Hans Solo" or says Python has cleaner syntax than perl, but you don't take the time to learn the rudiments of the English language.

English is a geek's dre

Re:How many times?

[DMUTPeregrine]

I agree fully with you. On a more humorous note, learn SolReSol, the best language ever.

Re:How many times?

[severoon]

English is so rich a language, in fact, that we naturally learn it as a meta-language instead of directly as a language. This is how we are able to decode the meaning of slang phrases that we've never heard before...these phrases strike a chord with us because they evoke imagery that is indirectly or obliquely referred to by phrasology with which we're already intimate. Even when expressing ourselves to audiences of unsurpassed erudition, we ought always sedulously eschew unmitigated hyperverbosity, obfusca

Re:How many times?

[multipartmixed]

> When your C compiler chokes on "maloc" do you
> whine that "it's obvious what I meant and
> anyway, languages evolve"?

Oh, ho - but the C compiler will never choke on malloc -- the linker will!

Otherwise, excellent points. ;) It's nice to see another geek express these sentiments; I thought for a while that I was the only one who felt that way.

Re:How many times?

[phatlipmojo]

Sounds like someone has never suffered through a nasty virius.

Re:How many times?

[Samuel Nitzberg]

Groups of unrelated viruses :

Viriis ?
Viriiii ?
viriiiiis?

Viruseses ?

I give up

Re:How many times?

[dasnake]

That depends on the language you use.
I don't really care about english, but in the common jargon the plural is 'virii' and in my mother language (italian) is just 'virus'.
A more complete article could be found at: http://en.wikipedia.org/wiki/Plural_of_virus/ [wikipedia.org]
For the people who will reply that english is the language in use on slashdot I would like to point that probably it's the english+jargon the language actually in use :P

Re:How many times?

[jpmkm]

What the fuck is common jargon? Are you talking about ignorant 13-year-olds? They are the only people who possibly have an excuse to say virii. It is just so completely stupid. By the way, your complete wikipedia article looks somewhat barren.

Re:How many times?

[severoon]

I would posit that it's nearly impossible for any group of intelligent folks to converse about a shared topic of interest without jargon.

sev

Re:How many times?

[chegosaurus]

And that the plural of box is boxes?

And that the plural of pizza is not pizza's?

And don't even get me *started* on "Unixen"!

This is news?

[tobechar]

I mean, c'mon people, the pocket pc is running windows. This virus isn't exactly revolutionary.

At least now I can justify the Zaurus [pdabuyersguide.com] over the 'other guys'!

Re:This is news?

[NanoGator]

"At least now I can justify the Zaurus over the 'other guys'!"

You'd jump to the $700 'distant 3rd' palm device that's nearly twice as big just to get around the potential of getting a virus that would be hard pressed to get to your system by simply adjusting your bluetooth settings? Pardon me, but the worst case scenario is you reset the PDA and re-sync it.

Yet another reason to run Linux on your PDA

[jerith]

We've come to expect decent security on desktops and servers, why not PDAs as well? At least it may make manufacturers think twice before jumping on the MS bandwagon.

Re:Yet another reason to run Linux on your PDA

[NanoGator]

"We've come to expect decent security on desktops and servers, why not PDAs as well? At least it may make manufacturers think twice before jumping on the MS bandwagon."

Seeing as how niether the PocketPC nor the PalmOS was built from the ground up with the idea of getting on the net right away, I'm not sure why you'd put any more faith in any PDA short of the Zaurus with its Linux based roots. (Yes, I realize you basically stated this in your subject line, but I don't see how you could ignore Palm in this

Re:Yet another reason to run Linux on your PDA

[Pantheraleo2k3]

-1, Outdated

To take a recent example, the Sony Clie UX50. It has built in WiFi and Bluetooth. You can use the builtin web browser to go to a Web site and download the .zip file with the things you need. You save it on an expansion card or the internal virtual card. You use the included software to unzip the files, then move them to main memory and they're installed.

Yes, it's only one PDA. Yes it is somewhat involved. Yes it only works on programs that aren't distributed in .exe Windows Setup program forma

Re:Yet another reason to run Linux on your PDA

[SpinyManiac]

That's just not true.
This [www.phm.lu] is one application that can be installed on the device. The default download is to install through Activesync, but you can download the .CAB.
For those of you with no WinCE experience, launching the CAB will install the program.

Re:Yet another reason to run Linux on your PDA

[Anonvmous Coward]

"That's just not true."

Did you really need the "that's just not true" bit? Besides being argumentative, your own post conflicts with it. "That is just not true, in the rare circumstance that one has installed this app."

I just ask because you could have phrased that more informatively without begging for a needless rebuttal.

Re:Yet another reason to run Linux on your PDA

[TheLogster]

Come on guys ... Linux is no more secure than windows, the only reason that it doesn't suffer as many attacks as windows platfors, is due to the fact that is at the bottom of the use OSes list (Windows = most used, mac = second, linux = third).

When I saw the news about the proof on concept, I knew people would be bitching about the fact that it was a MS product...

However, I am sure all you linux zelots out there know that the _first_ smartphone virus was written targeting the sybiam 60 OS.. http://www.the

Re:Yet another reason to run Linux on your PDA

[SphericalCrusher]

This is why I'd like to have Lycoris on my PDA. [linuxdevices.com] Or, well, just any form of Linux. Slackware would be nice. =)

Famous last words

[visgoth]

"We don't expect a major outbreak," said Eugene Kaspersky, head of anti-virus Research at Kaspersky Labs. "Duts is unable to spread independently, only infects a limited number of files, and signals its presence in the system when attempting to propagate."

Duts may not be able to spread, but take out the bits that make it "benign" and you've got the makings of a real annoyance. Even if the source for this particular virus is kept safely out of the hands of malicious individuals, the fact that its now been proven do-able means others will try.

Like the typical outlook virus

[Gopal.V]

Outlook Express: "do you want to open this file ?"
Joe Blow: "Yes"
** pc crashes ...

Ok, so how's this virus different ?.
Anyway Pocket PC viruses are going to be rarer than one for Macs ...

Reminds of Donut [zdnet.com] , the .NET virus ... but there hasn't been a real one in the wild yet ?.

bash$ alias kill='chmod -R 0666 /'

Re:Like the typical outlook virus

[poot_rootbeer]

Anyway Pocket PC viruses are going to be rarer than one for Macs ...

And Apple Newton viruses are going to be even rarer than THAT!

(and now, someone will reply with an obligatory Newton handwriting-recognition joke.)

bluejacking

[mpost4]

The user to my understanding still has to accept the incomming file. so just make it a polocy (like email) don't open a file unless you are expecting it. Better yet turn of bluetooth discoverbility.

Re:bluejacking

[b06r011]

The user to my understanding still has to accept the incomming file

as far as i know, it is possible to display a message on someone's phone without them giving consent. the trick is to create a bogus name in your phone book, and then send that. alot of phones will display a message like

"Buisness card recieved from Jon Smith - save y/n?"

however, to spook someone out (which is really the ultimate goal of bluejacking) you create a 'name' like

"is that a nokia?"

or when the beeps and bemused looks

Trustworthy computing...a myth?

[bogaboga]

What happened to the Trustworthy Computing paradigm? I guess if you now mention that to [Sir] Bill G., you might not get all that much! On the other hand, I ask myself why these coders (or virus authors) do not direct their energy to coding for OSS. So many projects need a hand. My help goes in submitting bug reports and cash whenever possible. [But] I could be wrong here, may be some already do something for OSS.

Mr Billy G is NOT a Sir

[NeonSpirit]

I know it's being predantic, but Bill G has an honorary knighthood. Only citizens of countries which reconise the queen as head of state can have full or substantive awards.

The rules are explained a little better here [wordiq.com]

obligatory

[Ari_Haviv]

Can your Palm do this?

I'm surprised we haven't seen Palm viruses.

[MtViewGuy]

Given how many PDA's and combo PDA/cellphones out there run PalmOS, I'm surprised that someone malevolent "cracker" hasn't created a virus that will cause problem with PalmOS-based units already.

And when that happens and it spreads in the wild, the results will be ugly. =(

Re:I'm surprised we haven't seen Palm viruses.

[brandorf]

There already are PalmOS viruses. See here [f-secure.com] for an example. The key difference is that PalmOS has had only recently gotten any sort of wireless connectivity. So these virus all spread via human intraction (i.e. Hotsync of an infected file, or IR beam of an infected file).

Give it time and there will be ones that spread via bluetooth or WiFi.

Re:obligatory

[Sepper]

I know the parent post was meant to be funny, but if you could make a palm virus, it could potentially be devastating. Don't know of any phone that runs PocketPC OS (Although i'm sure there are some...),but I know PalmOS runs on Phones (Like the Treo 600...). Any virus that could spread by calling could cause A LOT of trouble... like long-distance calls at random...

But unlike the Pocket PC OS, Palm OS is mutli-threaded, single-task OS. You would have to trick the OS into making the virus a new Thread of

Pocket Antivirus

[Caniffe]

"Is that a virus in your Pocket or are you just happy to see me?"

Bluetooth viruses...

[Audigy]

It would be interesting if the affected Bluetooth-enabled Nokia phones mentioned in a previous article a few weeks ago were somehow able to transfer their goods to PocketPCs ... ...come on now, how many people do YOU know with a Bluetooth-enabled PocketPC, who leave Bluetooth discovery on? (I have an iPaq 2215, but Bluetooth is off to save battery life)

This is a neat proof-of-concept, but I think these virus creators should go back to hacking cell phones if they want to make waves. :)

Re:Bluetooth viruses...

[S3D]

So called "Nokia virus" was a more a sham then a real threat. To spread it would require three time answer "yes" on different security warnings: "Recieve message via Bluetooth...?" Yes "Install Caribe ?" Yes "Application is not signed , identity can not be veryfied install on your own risk..." Yes. There is no way to bypass thouse messages.
It would be interesting if the affected Bluetooth-enabled Nokia phones mentioned in a previous article a few weeks ago were somehow able to transfer their goods to Pock

No Worries...

[wbav]

if you have an ipaq 1940/45. It seems if something writes to the "filestore" the rom becomes corrupt and it has to be sent back to hp. As my main memory is basically full, I'll know when a virus hits; my ipaq's rom will need to be reflashed.

Speading viruses via Sybian?

[Gothmolly]

The idea of spreading viruses via Sybian seems far more sinister, and far nastier. All things considered, it was only a matter of time before the Sybian was used as an infection vector.

Re:Speading viruses via Sybian?

[mrklin]

I am sure the above poster's comment was a tongue-in -cheek statement but for those that do not know:

Symbian is an OS.

Sybianb is anything but an OS.

Look it up!

What this really proves...

[agraupe]

This proves that every networked computer device can be infected with a virus. This makes it stupid and illogical to assume that there will be no security holes on any given OS. What matters is how severe those security holes are, and how quickly they are patched. It is in that area that linux is firmly ahead of Microsoft (and perhaps OS X, I'm not sure).

Re:What this really proves...

[Dan East]

The article doesn't mention anything about exploiting security holes. I get the impression that the virus spreads using any standard file transfer method. Obviously it could also spread over IrDA file transfer, but that doesn't mean it somehow exploits a weakness in that connectivity.

Also, why bother looking for and exploiting security holes when you've got ActiveSync? It allows the host PC full access to the Pocket PC filesystem, including the ability to execute programs. I would be far more afraid of

Pocket PC issues

[Dan East]

Creating a Pocket PC virus is a trivial matter. It uses the PE format, so I'm sure it would be very simple to adapt virii to infect Windows CE files - basically just a recompile of the virus source to XScale / ARM (assumming it is not in x86 ASM).

Windows CE is actually more secure than Windows XP because the majority of the OS is in ROM. Those files are protected at the file system level - it is not even possible to read or copy the files, let along modify them.

After an infection one could always do a hard reset to quickly have a clean device that is at least usable.

Also, the amount of damage that could be inflicted would be moderate because most PDAs are synchronized with a host PC. So the information on the PDA is essentially backed up multiple times a day.

The real concern would be a virus that could propogate over multiple platforms running different processors. This is one reason to be afraid of .NET / C# bytecode.

Dan East

Re:Pocket PC issues (ROM isn't magic)

[jetmarc]

> Windows CE is actually more secure than Windows XP because the majority of the OS
> is in ROM. Those files are protected at the file system level - it is not even
> possible to read or copy the files, let along modify them.

Keeping files in ROM does not inherently constitute a better virus protection.
Of course, altering a ROM file is (usually) impossible. However, any complex
operating system has a lot of options for RAM or FLASH based files to "hook-in",
and RAM and FLASH are certainly not impossible to alter.

A virus that hooks into the startup sequence of a pocket device is as effective
as a hypothetical one that managed to alter the ROM of that device. Sure, a
ROM device might have a "wipe-all" reset button that gets rid of the virus,
but it would get rid of all personalization data as well - files, installed
software, addresses etc.

So, how does that make the ROM device less vulnerable to virus attacks? It
can't be rendered completely unusable. Ok. But all the other threats continue
to exist. You can loose your data, you can spread the virus to other devices,
you could even sync a multiplatform virus to your desktop PC, etc.

Marc

Re:Pocket PC issues (ROM isn't magic)

[AnyoneEB]

I do not own a Windows CE machine, but Palm OS has a special reset mode where no OS add-ons are loaded in order to allow the user to troubleshoot problems with them (hold the up button while pushing the reset pin). In this mode it would be possible to delete any virus that has been installed and then reset regularly. I assume Windows CE has a similar option.

Re:Pocket PC issues

[djeaux]

Also, the amount of damage that could be inflicted would be moderate because most PDAs are synchronized with a host PC. So the information on the PDA is essentially backed up multiple times a day.

For PDAs that are regularly synch'ed to a desktop, couldn't the desktop antivirus be tuned to scan files destined for the handheld (or the handheld itself, for that matter)?

I know this option wouldn't be viable for the increasing number of folks who are fetching content wirelessly... But for folks using their

Oh great...

[Steve Cox]

If memory space for running programs on my PDA was not limited enough. Now I'll have to waste more of it running a virus checker.

Steve.

Re:Oh great...

[Oddly_Drac]

"If memory space for running programs on my PDA was not limited enough. Now I'll have to waste more of it running a virus checker."

Run the virus checker on your sync platform and stop whining.

Re:Oh great...

[Steve Cox]

Sorry. I made my reply to your post from another machine and went in as AC(0).

The general idea was:

CRAP IDEA.

If the PDA has bluetooth/irda you can get it that way (should an exploit be found). More importantly, if it has WiFi it will probably go into the mail server directly. Additionally, if you have WiFi, then you have an IP address which can also be attacked.

The desktop cannot help you at all in these cases.

Steve.

Re:Oh great...

[Oddly_Drac]

"If I have a WiFi card in my PDA I access the mail server and the web directly. If (or when based on other Outlook products) someone finds an Pocket Outlook exploit, what use is your desktop then?"

Absolutely none, however, 'if' someone steals your keys and makes a copy of them, what use is your front door? As people have pointed out, PocketPC is extremely heavily sandboxed and the last few worms/viruses haven't exactly stretched the imagination too much.

Security isn't about stapling a wrist to a foreh

Also mentioned

[floydman]

on CNET news [com.com]

You don't need viruses

[gilesjuk]

Windows Mobile is easy enough to mess up without viruses. It implements the registry like on desktop Windows, only it's harder to backup.

Quite a few people on the E800 forum I read have had problems where their Bluetooth stops working.

Do not use virii

[robnauta]

The word 'virii' never existed in Latin. The plural for 'virus' can be 'viri', but since the plural of 'vir' is also 'viri' even the old Romans avoided 'viri' as plural for 'virus'. Ending a word with 'ii' is not Latin, it's not common in any language. It's as obnoxious as writing Micro$oft.

Re:Do not use virii

[hugesmile]

Ending a word with 'ii' is not Latin, it's not common in any language. It's as obnoxious as writing Micro$oft.

You mean like aalii, genii, medii, modii, radii, torii, congii, bacchii, denarii, dochmii, nauplii, senarii, splenii, dupondii, perradii, retiarii, sartorii, sextarii, stapedii, trapezii, octonarii, interradii, septenarii, gastrocnemii.

Above list, courtesy of Jumble and Crossword Solver [uakron.edu].

Not saying that they're "common", but they do exi$t.

Re:Do not use virii

[James Turpin]

The difference here is that the first 'i' of the double 'i' is in the root word, so only one 'i' is added. The first 'i' in 'radii' is also in 'radius'. The first 'i' of the double 'i' in 'virii' is not in the word 'virus'. There is no double 'i' in any Latin declention suffixes (well, at least not 1st, 2nd, or 3rd declentions, which are the only ones I remember), so unless the root ends in an 'i' it's probably not proper Latin. But there are exceptions to most rules.

Or, to make it simpler, look-up 'v

Re:Do not use virii

[hugesmile]

I was just responding to the issue that "Ending a word in ii... is not common in any language".

I agree that you can just look it up.

...find its plural form in Enlgish
Not sure where I get an Enlgish dictionary, though! ;)

Re:Do not use virii

[robnauta]

You are right I should have said there is no 'ii' plural. If the 'i' is before the 'us' like radius it becomes radii but that is then radi-i, the i's are together by coincidence, they do not belong together.

Re:Do not use virii

[/dev/trash]

Funny thing is, we speak English, not Latin. As a nation we can make up words as we like.

comparative endemics

[Doc Ruby]

PalmOS viruses have already been reported [cnn.com]. PalmOS has a larger market share than PocketPC. Can these numbers be used to understand the relative importance of availability versus vulnerability in the incidence of info viruses?

Oh Boy, economic boost!

[DarKnyht]

Just think of all those Symantec Anti-Virus for Pocket PC software packages Symantec is going to sell to the stupid masses.

This isn't new...

[joeblackattack]

A grad student did this at ISU over 2 years ago when the iPaq was new. His virus didn't do anything harmful but it did propogate itself over wireless newtworks and was an interesting demo for the computer engineering ugrads.

As Uncle Cecil

[ewn]

As usual, The Straight Dope [straightdope.com] has an exhaustive entry on the issue:

The one inescapable fact is that in classical Latin, there was no plural of the word. In English, the only correct plural is viruses.