Read on for the interview.
MT: Do you have a mobile or a security background?
AD: My own background is in mobile. As a company, SimWorks has evolved into security. We have been developing for the Symbian platform for a number of years now, so we are very familiar with what is required to build a solid app and also with the mechanisms that developers of rogue software can use to damage customer's phones, data or credit with their phone company.
MT: When did you first get the idea for mobile phone security software?
AD: We had been considering the development of a range of security applications for some time, however there did not appear to be a need for them at the time, so they remained on the drawing board. When Cabir was first identified we realized that it would not be long before many more worms and trojans for the Symbian platform appeared so we were quick to respond with the first version of SimWorks Anti-Virus.
MT: What kind of risk is there for the average consumer with a Series 60 phone?
AD: The current risk to most mobile users is fairly low, however this will definitely change as the year progresses. Obviously, anyone that uses Bluetooth or that downloads applications from the web faces a greater risk of receiving something that could damage their phone. Anyone that regularly downloads unsigned applications from the Internet, especially warez (Ed. note: warez is a common term for illegal pirated software), is at extreme risk–many of the people that crack these applications are starting to insert malicious code into the cracked files. Warez is presently one of the primary vectors for the spread of Symbian malware.
MT: How sophisticated is the malware that your company has detected to date?
AD: We're in the very early days for malware on the Symbian platform. Most authors of the malware that we have seen to date make some pretty elementary errors. In many cases they are trying to use other people's work but make a simple mistake somewhere—we see this a lot with attempts to embed Cabir into a Trojan in order to make it able to spread.
Of course, considering the sort of damage that some of these trojans can do to users' phones today when the guys writing this stuff don't really know what they're doing, what sort of harm will they be able to cause when they have more experience developing malware for Symbian?
I expect malware for the Symbian platform to rapidly increase in sophistication in the short term as virus writing groups get more organized and as a result of the publishing of source code for the likes of Cabir and Velasco. People new to the Symbian platform will be able to study the code for these proven threats and incorporate their functionality directly into their own applications.
MT: Do you think the threat of malware will mean consumers may shy away from smartphones?
AD: I think that the inherent flexibility of smartphones offers a compelling value proposition to consumers. So no, I don't think that consumers will begin to vie away from smartphones if the risks continue to grow.
MT: When do you believe Symbian phones will start to ship with security software?
AD: Several Symbian phones already ship with security software and it's clear to us from the discussions that we're having with the handset vendors that there will be a lot more shipping with security software by the end of the year.
MT: Are there more efficient ways than Bluetooth or warez SIS files for mobile malware to spread?
AD: Yes, although we obviously can't go into much more detail than this. Symbian phones have a great many more ways to communicate than just Bluetooth and certainly a great many more ways than your standard PC. Anything that can be used to transmit data can be a vector for the transmission of malware to the handset.
MT: I think you mentioned in an earlier conversation that Bluetooth can be "All the way hacked" so users won't have to accept to download malware... Can you expand on that a bit more?
AD: If someone were to discover an exploit say in the in the Bluetooth stack which would enable the transmission of files to users phones with out asking the user for permission then this would substantially increase the ability of such a trojan threat to spread in the wild.
MT: It wasn't until always on Internet access that PC viruses got really bad, do you think 3G data services will do the same thing in the mobile industry?
AD: The introduction of 3G data services may have a similar effect to the spread of malware on phones as always on Internet connectivity has had on the desktop. The reason for this is not because 3G data services are always available (this always on connectivity has been available to Symbian users for years via GPRS) or the higher bandwidth of 3G connections. However, the huge investment by operators in 3G will mean that they will be heavily promoting the use of 3G data services and perhaps pricing them quite aggressively. It may be that the introduction of 3G data services will exacerbate the spread of malware on the Symbian platform not because of the availability of the service but because of the changing behaviors of mobile phone users.
Operators will definitely need to consider deploying some form of antivirus service to their customers in tandem with rolling out 3G data services to meet this threat head on. WAP was a promising technology that delivered an initial poor user experiences which ultimately made it a consumer failure. Likewise, if consumers data experience is not safeguarded then some early negative experiences of application download may lead to a backlash against data services which considering the level of investment by operators would be a disaster of significantly greater proportion than WAP.
MT: Is there anything else that you want our readers to know?
AD: I guess that we'd just like to add that the time is fast approaching when consumers, and enterprises and operators need to start taking the mobile threat seriously. Enterprises and operators should be evaluating solutions now so that they are prepared for the inevitable. End-users can purchase a copy of SimWorks Anti-Virus from our site or any of the leading mobile portals such as Handango. Enterprise customers and operators should contact us for more information on pricing and an opportunity to evaluate how our mobile solutions can meet their needs.
If any enterprise customers were interested in evaluating our product then they should contact us.
Please let us know what you thought about this piece and if you would like to see more interviews with industry leaders.