Windows Mobile MMS Virus Discovered

It is surprising–and also commendable–that, from a house such as Microsoft, often criticized for the lack of security in their operating system, came another product that has had no major virus attacks since the launch several years ago. Windows Mobile has enjoyed a relatively "safe" tag for a while now, but that might change with the discovery of a new vulnerability in its handling of SMIL (Synchronized Multimedia Integration Language). What this means is that a user can send you a malicious MMS can infect your WinMo PPC and in turn send the SMS to other users in your phone book, spreading just like virii do via email.

This malicious MMS has already been made, but fortunately, it is only proof of concept code written by Collin Mulliner, the discoverer of the vulnerability. Apparently he had submitted the bug to Microsoft six months ago, but on receiving no response, he decided to show it off to the public at the 23rd Chaos Communication Congress held in Berlin, Germany.

An MMS virus was also discovered last year for Symbian OS Series 60-based devices, but it didn't proliferate because it used Bluetooth to send itself to nearby phones. With Bluetooth still turned off on most devices when not in use, the virus attack was automatically contained.

The HP iPAQ 6315 and i-mate PDA2k have been confirmed as vulnerable to this new SMIL exploit and other devices running Pocket PC 2003 or Windows Mobile 2003 may also be affected. However, due to the technicalities of the bug, it is necessary to know the exact memory location where the code may execute, so it may not be an easy task to make a 'one-size-fits-all' MMS virus for Windows Mobile.

In all fairness, it's safe to say that Windows Mobile is still as safe as ever!