Can malware on my computer infect my phone?

Question

Suppose my computer is compromised or has malware. Can the malware spread to my phone? If so, how? Has any malware been observed in the wild to do this?

Relevance: Some banks use two-factor authentication of online banking transactions; when you want to make a transaction, they send a confirmation code to your phone, and then you need to enter it into the web site to confirm. This is intended to protect against fraud by malware on the customer's computer, but if malware can spread from your computer to your phone, this protection looks less effective. Also, a number of web sites have started to use two-factor authentication, and they would be affected similarly.

Related: Can a compromised mobile phone be used to penetrate a desktop or server? asks about the reverse scenario.

Answer 1

There is no reason why malware cannot spread from any kind of device to any kind of device, it all depends on how the malware has been developed. AFAIK there is no malware known that infects both PCs and mobiles at this point, but there's no reason it can't be done. Possible vectors are:

1. infected music files: a malware infected music file could be spread to a mobile during some sort of sync, like an itunes sync
2. Over the network: mobiles are often connected to wireless networks, malware could be designed to use vulnerabilities in mobile OSs to infect them
3. Over a USB connection: when you connect your mobile to your computer communication is possible between the 2 devices, and communications path is a possible malware infection vector
4. Bluetooth

Of course there are other ways a mobile could be infected (phishing, infected emails, etc), but they are not a direct spread from a computer to a mobile.

Answer 2

Some mobile phone users "sync" their device with their PC/Mac (that's how you can transfer music files from the PC to the phone, at least) and the sync feature tends to include everything that is not the base OS (in particular apps). Therefore, there is a privileged transmission channel from the PC to the phone. Assuming the existence of a "malware app", it would be trivial for an infected PC to add the app in the list of to-be-synced apps. The same transmission channel could be used to transfer specially crafted files to exploit security holes in the phone (and this one assumes the existence of such holes, of course).

If we are to believe Apple's/Google's marketing, the apps are signed and this, supposedly (and somewhat magically) prevents the apps from being malicious. I am not totally buying this, though. I am ready to admit that an evil app will be eventually removed (e.g. with some certificate revocation), but I don't believe that it will be done promptly (it would take a few days, at least).

One might note that when a device is jailbroken and the app signature system deactivated, then the vulnerability is noticeably increased.

Answer 3

It is entirely possible, although I don't think it has happened as of yet.

The jailbreaks against iOS (like Redsn0w) work by tethering the device to your desktop. Although this is not quite as simple as just plugging your phone into your computer, It is pretty close. Attack surface is exposed by a device that is plugged into a computer.

Charline Miller's NFC attacks are promising. One of his attacks against Nokia phones allows him to mount the file system over bluetooth. Although no PC has NFC, most have bluetooth.

Really the most likely attack would be something like Chrome to Phone to deliver a browser based exploit. The browser is still the largest attack surface on a mobile device.