As this incident clearly shows, signing of applications is not a guarantee of safety. A digital signature tells you that program has not been tampered with since it was signed and who signed it. It does not tell you that the creator had your best interests at heart nor does it tell you that the signer knows every byte of the application and what it will do. In the case of Symbian Signed applications there is also a security check but no check is perfect. Even if every application was checked by a human researcher mistakes would still happen. Humans are, after all, human.
As my colleague at Sophos, Paul Ducklin, wrote strong authentication cannot eliminate fraud. http://www.sophos.com/security/technical-papers/phishing-and-fraud.pdf
Signing is an identification technology, not a guarantee of security.
Earlier this month, a mobile malware known as Transmitter.C, Sexy View, Sexy Space or SYMBOS_YXES.B, slipped through Symbian’s mobile code signing procedure, allowing it to act as a legitimate application with access to device critical functions such as access to the mobile network, and numerous other functions of the handset.
Upon notification, the Symbian Foundation quickly revoked the certificate used by the bogus Chinese company XinZhongLi TianJin Co. Ltd, however, due to the fact the revocation check is turned off by default, the effect of the revocation remains questionable.
What are the chances that future malware authors could bypass the code signing procedure again?
Before answering the question, it’s worth pointing out how they manage to do it in the first place. According to F-Secure, the authors of SYMBOS_YXES.B seem to have digitally signed their malware by using the Express Signing procedure, taking advantage of the lack of human inspection. Another variant of the malware was also digitally signed in February.
The missing human inspection, instead of the total reliance on mobile antivirus scanner, could have prevented the signing of the malware, since the malware authors didn’t even bother to create a fake company page on the Internet in an attempt to improve their legitimacy. For instance, none of the previously used Chinese company names (XiaMen Jinlonghuatian Technology Co. Ltd., ShenZhen ChenGuangWuXian Tech. Co. Ltd. and XinZhongLi TianJin Co. Ltd.) have any public reference.
And while the mobile malware campaign is not necessarily widespread, it remains active, with the malware domain SMS-ed still online, and hosted by the U.S based Global Net Access (GNAX), which hasn’t responded to abuse notifications throughout the past 30 days.
The Symbian Foundation is investigation how they can improve the signing procedure, and detect malware before they issue yet another certificate to its authors. Over 2000 applications go through the signing process each month.
, always remember that your mobile digital world carries critical information both for the user and for the corporate environment.
