It has been widely trailed, and was only a matter of time, but the first virus affecting handhelds has been found in the wild.
Both Symantec and Kaspersky have detected a backdoor Trojan horse program that can give an attacker control over a Pocket PC mobile device.
The big problem though is that the anti-virus firms don't have a quick cure and say the only way of defeating the Brador virus is to completely reinstall the Windows CE operating system.
Anti-virus companies do offer applications for mobile devices but for systems infected with this virus, Symantec has recommended deleting the /Windows/StartUp/svchost.exe file in the Windows CE operating system and completely reinstalling the OS and all the applications. Not exactly an ideal solution.
"It's one of the first backdoor Trojans we've seen for Windows CE," says Oliver Friedrichs, senior manager with Symantec Security Response. "It's not really widespread. We've only seen one instance at this point. But it does show where attackers are going."
Symantec calls the virus Backdoor.Brador.A. Kaspersky Labs, which also issued an alert, dubs it Backdoor.WinCE.Brador.a. It is 5632 bytes in size, so it can easily spread through e-mail or as a download from a website to a personal digital assistant. Kaspersky Labs suspects that Brador was written by a Russian coder since it was discovered in an e-mail with Russian text.
Once Brador runs, it copies itself to the svchost.exe file in the Windows autorun folder and seizes control over the system after a restart. "It would give them total control if it got on," says Phebe Waterfield, a Yankee Group security solutions and services analyst.
"It e-mails the attacker your IP address," says Symantec's Friedrichs. "The attacker can then connect back, access the backdoor, look at your files, download the files, or even upload other malicious code."
Last month, a benign virus affecting Windows CE was sent by its authors to anti-virus companies, raising everyone's fears and expectations about a forthcoming PDA virus. It prompted one expert to state that such viruses were going to have a far worse effect than their equivalents aimed at PCs.
In June, the first virus aimed at mobile phones was also discovered.
Because of the limited nature of Brador's dissemination, Symantec gave the virus its lowest threat level. "It's not going to spread itself," Waterfield says. "But it's setting a very scary precedent. It's fulfilling a prediction that the security folks have had for a long time - that the threats on desktops are going to spread to these kinds of devices."
The big problem is that Windows CE and other operating systems for PDAs don't have the security capabilities of Windows XP, Waterfield says. "The latest version, Windows CE.Net, does have more of these features, but with older PDAs you couldn't even set permissions within the device. Any data, or even passwords, could be exposed by this Trojan," she says.
Any mobile device based on the ARM processor is vulnerable to Brador, so Friedrichs recommends taking care when receiving files. "Be careful you don't download anything or read e-mail that may contain a backdoor Trojan, for example, an executable file," he says. "Make sure you trust the source and the file has been authenticated."
Waterfield also suggests that corporations create usage policies for their employees with mobile devices. "Make sure they're using password protection. Don't download any untrusted code. Run some anti-virus software. And keep very sensitive information off the device altogether," she says.
The anti-virus vendors say they are continuing to refine PDA anti-virus applications. Brador is "one sample of what we're really expecting to be a growing trend in terms of mobile computing and mobile devices because their functionality is becoming closer to a PC," Friedrichs says. "It brings the same attacks you see on the home PC right down to the mobile device."
Find your next job with techworld jobs