A blog from security vendor Symantec estimates that there are 50,000 new infected computers daily thanks to the Conficker worm.
They have a really nice map on their site which shows the spread of the worm around the world. Thankfully New Zealand seams relatively clean – because for some reason we don’t even make it on the map!
In the business this is known as ‘security by obscurity’ – and generally doesn’t work.
Computerworld has this story about a security analysist who even after finding the ‘first’ vulnerability in Google’s new Android mobile phone operating system seems to think that the OS is secure enough not to need AV software.
Miller is quoted as saying “If you want to do anything dangerous like access personal contacts, you have to specifically say to the virtual machine ‘these are things I’m going to have to do,’ and the virtual machine will ask the user if that’s OK,”.
The problem with this is that it relies on the user being able (or being bothered) to give a satisfactory answer. Peter Gutmann says that relying on users to always make a sensible decision is ultimately flawed because it relies on the user being omnicient – knowing exactly what they want and how to achieve it.
The story then goes on to say that hackers have found a way to install software on the phone bypassing the virtual machine! So even if the user is expert enough to understand whether an application should be allowed access to the Android OS, a hacker can bypass this security feature anyway.
Although this type of attack is not unique to Android, the article claims people don’t generally use their phones for accessing the same kind of important data they do on their PCs, making phones less of a target.
Nevertheless there are several antivirus software offerings for mobile phones. This is a good thing. Having worked in a polling booth this weekend and seen how many adults couldn’t even work out how to place two ticks on the ballot paper, I’m not hopeful that they’d competently answer a question thrown at them from an android.
