Symantec AntiVirus 2002 for Palm OS Announced

I think it's a good thing that there are Palm based anti-virus packages out there. We may not need one today, but there's a good chance we'll need one eventually.

There are lots of ways. You could download a game from a reputable download site that has a Trojan virus in it. Once run it could create a new file that was the virus (to be activated at a later date), you'd never know the game was the problem.

Viri can be spread via IR communications. There's nothing to stop an application noticing that the IR is about to send, then jumping in and taking control and transmitting a virus instead / as well as the intended file to be beamed.

If your Palm is used wirelessly, there're many more ways. Badly formated SMSs could cause problems, as could attachements to emails (for eample MultiMail can send attachments to other applications).

What about if your device has Bluetooth? Would be quite easy for a badly written BT app to allow a maicious 3rd party to get into your device, or even for an app to install a deliberate back-door to your Palm. 802.11b has similar problems, and it is certainly susceptible to a simple ping based DOS attach from anyone in the same area.

And then there's WebClipping - did you know that a link in a Web Clipping page can launch any application on your device? Great way to activate an application that sends all your personal data to an address on the internet. And it wouldn't be hard to cover this up and make it look like the link you clicked was slow.

That enough ways to get a virus on a Palm?

>ANd if you do get a virus on your Palm OS device
>whats teh worse that can happen? Oh spend 25
>minutes to reload everything back on.

To start with, the virus could easily be backed up in the same way as your other programs - so once you restore your Palm, it will once again have the virus. You'd have to know which file was the virus - which would be very hard, as it may not be called anything obvious. It could easilly look like a system file called 'datebk_US' that wasn't even of type 'appl' (application).

Or perhaps the virus installs itself in flash memory so it's always there. Maybe it crashes your device when it is reset. Not many people would know how to stop a reset-crash and then be able to delete a file from flash.

Maybe the virus doesn't activate in a loud and obvious way. Maybe it just deletes a couple of contacts and todo items, every day (making sure they're not backup up next time you HotSync). You may loose quite a bit of data permenantely before realising you have a problem.

There are many ways your PalmOS device could be infected, and many ways that this infection could be damaging. Just because it hasn't happened yet doesn't mean it won't.

Cheers
Russell

---
russ@russb.fsnet.co.uk
---
Diga ao Falante pelos Mortos
---

there is a small percentage of virus writers who enjoy the challenge of getting past the various security barriers.

Everybody else is out to be cool, be destructive, or commit crimes. Do you think the guy who wrote the virus that inserted into your Quicken application electronic funds transfers to his account wouldn't have done it unless you were running antivirus software? You're whacked if you do.

To address your points individually:

>1. Hotsync: PC-based virus scanners keep you
>covered here, so any program installed this way is
>safe.

Are you sure? I certainly wasn't aware that PC based virus checkers also checked for viruses on other platforms. I'm sure that your .PRC and .PDB are checked, but is the virus checker looking for Palm specific viruses? (and if so, is it also looking for PocketPC ones, and BlackBerry ones, and Symbian ones, and Stinger ones, and so on... if so it's wasting a lot of time doing this for all the platforms you don't own).

Even if some anti virus sotware does this, do they all? I'd suggest people check their AV software before assuming they can HotSync and old crap to their device.

>2. IR: This is a limited-range thing, so
>you always know who is sending you stuff.
>If they send you a virus, you can reach
>out and grab them!

This assumes that the virus activates as soon as you receive / run it. What if you are beamed a game, check it works, play it a few times, get bored of it and then delete it. But... during this time, this innocent looking game has installed a trojan application onto your Palm? What if it beams itself to other devices every time you beam to someone, all the time without you even realising you've got a virus? Then at some datein the future... you and everyone you've beamed to get hit by a nasty virus?

>3. Wireless: This is the ONLY valid reason
>to use a palm-based virus scanner. Currently
>there are very few people using this, when
>compared with the size of the number of PalmOS
>devices out there. And the way the wireless
>services are going, this isn't going to
>change anytime soon.

At the moment, wireless operation on the Palm don't pose a huge problem. Most people can't get email attachements, mail programs don't have builtin scripting, and files aren't downloaded and then run on the Palm.

However, that doesn't mean there aren't risks, as there are email attachments that can be read (for example using MultiMail), and WebClipping (and other browsers) alow the execution of any application on the device without the user having to OK it. Combined with a trojan application, this could easilly result in all your Palm's information being sent to an address on the internet.

As for the future of wireless data access, its going to keep getting bigger. Maybe not in the US where coverage, proprietory standards and culture are preventing uptake, but in the rest of the world expect to see wireless data access rise quickly as Bluetooth and GPRS take off next year (Bluetooth and GPRS gives you an always on wireless connection via a (cell) phone).

>4. Cards: This is relatively new (except
>for TRGPro's). For ROM-based cards,
>this isn't a problem any more than a
>virus on a CD for PC's. An alarm goes
>out and everyone is warned about it.
>For other cards, it's the same as floppies.

Yeah - and they used to spread viruses quite well as I remember.

>And to get data on these cards, you need
>to use (1) (2) or (3), so this in itself
>isn't much of a problem.

Well... not completely true. Someone may give you a card, you may get one second hand, you may borrow a card off someone. These are all opportunities for your device to be infected. Also there are other ways for data to get on a card than the above 3 ways - card readers remove the need for a HotSync (which may be when AV software checks Palm files for viruses). Cards are used in other devices, phones, cameras, robot dogs... lots more opportunities for viri to infect yor card.

Cheers
Russell

---
russ@russb.fsnet.co.uk
---
Diga ao Falante pelos Mortos
---

Doug

Program:
http://download.antivirus.com/ftp/products/pccillin/pccipalm.zip

Virus definition updates:
http://www.antivirus.com/download/pattern.asp#Wireless

- Trolly

****************************************
The trolls always have the last laugh...