Is There an App for Security?

At the RSA 2010 Conference, a couple of researchers showed how easily botnets can be spread through malicious applications.  In an article for Dark Reading, Kelly Jackson Higgins wrote:

Derek Brown and Daniel Tijerina, security researchers with TippingPoint's Digital Vaccine Group, demonstrated how their seemingly innocuous weather app -- called WeatherFist -- gathers information on the users who downloaded it, including their GPS coordinates and phone numbers.

Within an hour of the app being set up on the SlideME and ModMyI app sites, the researchers had 126 downloads, and 702 after eight hours. "After 24 hours, we had 1,862," Tijerina says. And as of yesterday, the count was 7,800 iPhones and Androids running the app. "This was really surprising because if this was malicious code, that's a lot of bots we would control," he adds.

To prove the dangers of a mobile botnet, the researchers also wrote a malicious version of WeatherFist, called WeatherFistBadMonkey, that appears to the user as WeatherFist, but is really running bot code and can grab contact information, cookies, and physical addresses, and can send spam runs. They have run this app only on their own phones, not on those of their WeatherFist users.

As I've discussed before, smartphones require good security policies.  This policy needs to extend to both downloading apps and developing them. Lisa Phifer wrote for SearchMobileComputing.com:

Being prepared is half the battle. If your IT department cannot exert full control over smartphones and the apps they run, acknowledge that users are at least going to try to download a few personal mobile apps. Educate your workers about "app store best practices." Identify download sites that scrutinize published apps (e.g., iTunes) and those that don't. Explain the importance of checking digital signatures before installing apps and why users should not ignore signature warnings or follow developer suggestions to disable validation. A signature does not imply that the developer has passed any "security tests" -- but developers who aren't willing to sign their apps are suspect, and malware posing as another developer's legitimate app can often be detected this way.

On the development side, Fortify Software has warned that developers of apps for smartphones must embrace the principles of secure code development; otherwise, the integrity of users' mobile phone data could be at risk.