track your movements. Malware surreptitiously installed on your smartphone can actually transmit your calls so that a third-party listener can eavesdrop on your conversations. At a security conference in May, Zajac says there was a proof-of-concept demonstration of a hacker rootkit installation on a smartphone, and the rootkit could be triggered by a text message so that the activation of the program would be invisible to the user.
In thinking about it, though, I realized I’m always reading about Internet-based attacks on financial computer networks, online shopping networks, and other commercial IT networks—but when do we hear about hacker attacks on mobile phones? Or enslaved smartphones taking part in botnet attacks?
Such attacks are indeed rare—but only for the time being, Zajac said, “This is all about making money for cyber criminals and organized crime. If the platform is prevalent and has sufficient computing power, it will be attacked for purposes of cyber crime.”
Cyber criminals have not focused their resources on mobile technologies just yet, Zajac said, in part because there are many different mobile operating systems—Symbian, Research in Motion, iPhone OS, Windows Phone, Linux, and Android. Smartphones and other mobile devices also don’t store much data of value to cyber criminals. That’s because smartphones typically don’t store databases, and instead accessing information from databases in the cloud, according to Zajac. Still, smartphones are increasingly carrying around more data, and more and more apps have built-in databases. So it won’t be too long before you can put a laptop’s worth of information onto a phone.
But he predicts mobile systems will come under attack as the wireless industry develops technology that enables people to make retail purchases and conduct other business transactions using smartcards or other near-field communications technology embedded in their smartphones.
“The information flowing in and out of your smartphone can be compromised,” Zajac says, “so you’re at very high risk.”
In short, mobile platforms are not a target yet. But they will be, and that’s the challenge Eset and the wireless industry is moving to address.
