Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose my computer is compromised or has malware. Can the malware spread to my phone? If so, how? Has any malware been observed in the wild to do this?

Relevance: Some banks use two-factor authentication of online banking transactions; when you want to make a transaction, they send a confirmation code to your phone, and then you need to enter it into the web site to confirm. This is intended to protect against fraud by malware on the customer's computer, but if malware can spread from your computer to your phone, this protection looks less effective. Also, a number of web sites have started to use two-factor authentication, and they would be affected similarly.

Related: Can a compromised mobile phone be used to penetrate a desktop or server? asks about the reverse scenario.

share|improve this question
    
Interesting question for research. As malware may spread to USB sticks, this has probably happened on cellphones or will. –  Henning Klevjer Oct 17 '12 at 16:26
    
If your mobile runs windows xp, than definitely yes. In any other case, the update process is quite OK, but making some jpeg which runs shellcode from the photofolder is just a matter of time. Anyway, cross-platform ways are very rare, and running exploits from mobiles against pcs seems difficult, because you cant compile it just like that on iphone, you need to download it and bypass protections. –  Andrew Smith Oct 19 '12 at 1:55

3 Answers 3

up vote 3 down vote accepted

There is no reason why malware cannot spread from any kind of device to any kind of device, it all depends on how the malware has been developed. AFAIK there is no malware known that infects both PCs and mobiles at this point, but there's no reason it can't be done. Possible vectors are:

  1. infected music files: a malware infected music file could be spread to a mobile during some sort of sync, like an itunes sync
  2. Over the network: mobiles are often connected to wireless networks, malware could be designed to use vulnerabilities in mobile OSs to infect them
  3. Over a USB connection: when you connect your mobile to your computer communication is possible between the 2 devices, and communications path is a possible malware infection vector
  4. Bluetooth

Of course there are other ways a mobile could be infected (phishing, infected emails, etc), but they are not a direct spread from a computer to a mobile.

share|improve this answer

Some mobile phone users "sync" their device with their PC/Mac (that's how you can transfer music files from the PC to the phone, at least) and the sync feature tends to include everything that is not the base OS (in particular apps). Therefore, there is a privileged transmission channel from the PC to the phone. Assuming the existence of a "malware app", it would be trivial for an infected PC to add the app in the list of to-be-synced apps. The same transmission channel could be used to transfer specially crafted files to exploit security holes in the phone (and this one assumes the existence of such holes, of course).

If we are to believe Apple's/Google's marketing, the apps are signed and this, supposedly (and somewhat magically) prevents the apps from being malicious. I am not totally buying this, though. I am ready to admit that an evil app will be eventually removed (e.g. with some certificate revocation), but I don't believe that it will be done promptly (it would take a few days, at least).

One might note that when a device is jailbroken and the app signature system deactivated, then the vulnerability is noticeably increased.

share|improve this answer

It is entirely possible, although I don't think it has happened as of yet.

The jailbreaks against iOS (like Redsn0w) work by tethering the device to your desktop. Although this is not quite as simple as just plugging your phone into your computer, It is pretty close. Attack surface is exposed by a device that is plugged into a computer.

Charline Miller's NFC attacks are promising. One of his attacks against Nokia phones allows him to mount the file system over bluetooth. Although no PC has NFC, most have bluetooth.

Really the most likely attack would be something like Chrome to Phone to deliver a browser based exploit. The browser is still the largest attack surface on a mobile device.

share|improve this answer
    
It somewhat has happened, but not with malware. There's a site that remotely jailbreaks iPhones via a kernel remote code execution vulnerability. Just a one-click process and it does the whole thing over the net. Part of the process involves uploading new binaries, so it could certainly be considered a close analogue of a real attack. Considering we can also do this via tethering, as you mentioned, it's pretty much a done deal. –  Polynomial Oct 18 '12 at 8:49
    
@Polynomial that happened! It delivered a remote code execution exploit via a PDF and then jailbroke the iphone. Crazy stuff. –  Rook Oct 18 '12 at 15:17
    
Haha, that's nuts. I knew there was a valid reason why I don't put anything of importance on my phone... –  Polynomial Oct 18 '12 at 15:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.