Reports circulating out of Spain this week that a computer worm was able to spam wireless phones within its country's borders via email has raised questions over the existing protection of wireless devices from malicious code attacks.
Security experts agree that future harmful assaults could be directed at and spread by non-desktop computers, but the technological barriers surrounding those devices are likely too difficult for virus or worm creators to overcome in order to infect users en masse, such as the infamous "I Love You" worm.
"It's definitely possible. It makes me a bit uncomfortable," said Shawn Hernan, CERT Coordination Centre team leader for vulnerability handling in Pittsburgh, Pennsylvania. "I think it's an issue worthy of consideration, but I don't think the palm tops have gotten to be critical devices for many people."
Hernan said there are two trends emerging in the wireless field that should ultimately determine its email virus vulnerability fate; namely, how much more powerful and consolidated will portable general-purpose computers become and how important a role will very specialised computers with limited functionality encompass.
At least two antivirus security vendors in Europe said they received calls last week from consumers who claimed their wireless phones were spammed with "propaganda" language denouncing Spanish telecom giant Telefonica SA.
The day after news of the Visual Basic Script (VBS)-based email worm, dubbed Timifonica, surfaced, Telefonica released a statement denying those claims. Based on reports, Timifonica did not carry a destructive payload or delete any files.
Security companies in Europe said the worm spread via email through addresses in Microsoft Outlook and attacked wireless phones by sending SMS (Short Message Service) to random GSM (general standard mobile) phones through a gateway operated by Movistar.net. Movistar is a brand of Telefonica.
The spread of any virus or worm is governed by the tools of the population it is designed to attack, according to analyst James Kobielus at The Burton Group in Utah. Because of the nonexistence of a vendor monopoly in the wireless market, and the thin-client nature of most of those products, Kobielus said any large scale-type catastrophes are unlikely.
"There won't be that much of a mono-culture in terms of wireless mail client implementation," Kobielus said. "There will be vulnerabilities, but a virus targeted at one vendor's implementation of one vendor's client that's web-enabled might not be able to disable or affect someone else's WAP (wireless application protocol). People who create viruses are looking for impact."
When considering wireless devices' limited memory and limited storage locally, incorporating stronger security features such antivirus protection into circuitry would not be cost-effective (or virus pattern upgradable) and might take away from their "quick and easy" compatible appeal, Kobielus added. He said true wireless protection must lie at the server level.