Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I cannot find anything on google that indicates there has been cases of malware on Windows Phone 7, doe's anyone know if this is true?

share|improve this question
    
The question could be improved by changing "doe's anyone know if this is true?" to "does anyone know of malware that targets windows Phone 7 running on mobile devices?" –  Duncan Oct 26 '12 at 12:14
add comment

2 Answers

It appears Flame can hit Windows Phone 7 as Microsoft just released a patch to address an attack via the Microsoft update vector using the cert flaw (Information Week article of 5 June 2012). So that answer is yes there is malware that attacks Windows Phone 7.

share|improve this answer
    
That's not quite accurate. Yes, Windows Phone 7 is affected by the vulnerability, but I believe Flame itself doesn't target WP7. –  Steve Jun 18 '12 at 17:47
    
is there malware that exploits this vulnerability on mobility devices or is it just assumed? –  Duncan Oct 26 '12 at 12:17
add comment

No. As of right now there is no known malware for windows phone 7. Hence the difficulty in finding any information about it. This includes Flame. Unlike how Apple made their phones, the Windows Phone 7 OS and Windows 7, XP, etc., share very little similarities. IE, unless one was to write a piece of malware specifically for Windows Phone 7, it would not run on Windows Phone 7. The one thing they do share in common is Silverlight. Sorry for the uncertainty, as I am no expert in Silverlight or Windows Phone 7 development, but it seems like it would be possible to write malicious code for Silverlight on Windows and have it be portable to Windows Phone 7. The reason I think this isn't possible, is because Silverlight is run through a browser on Windows 7 but Silverlight is not supported through the browser on Windows Phone 7. Again I'm sorry for the uncertainty, perhaps instead of down voting, someone could shed some light on if that is indeed correct.

With that being said, Windows has taken several preventative measure which make it highly unlikely that malware will ever affect a Windows Phone 7. One such measure, is much like the iOS app store, all the available content to be downloaded from the Windows marketplace has been checked for quality as well as malicious content.

After an app is installed on the phone, much like Silverlight for regular Windows, the app gets it's own isolated storage. This allotted space is the only space the app has access to, likewise, no other app has access to this space. It's completely isolated from the rest of the phone's storage.

Much like the storage isolation, every app is run in a sandbox environment. Within this environment apps do not have access to certain resources, such as the file system as previously mentioned, if an app needs access to other resources it can do so using the API Window's has set up for this purpose. This includes access to other applications but this API does not allow one application to return data to another.

The browser is also sandboxed and is not able to launch code from websites which in turn helps reduce the risk of a web based attack.

Sandboxing is obviously not full proof, Android phones also run their apps in a sandboxed environment and there is obviously malware for those devices.

Finally, although this is not a security measure it does apply to Windows Phone 7. Windows Phone 7 has always had a very small share of the overall mobile market place. Why bother writing malware for a device that <5% of the marketplace uses when you could write one for a much larger portion? Especially since the Android marketplace has had only nominal success in preventing malware. It seems as though it'd be a waste of time.

It should be noted, that not every security measure is full proof and it's not impossible for the phone to get malware. For example, if you jailbreak/dev your Windows Phone 7 device, you can install whatever you'd like onto, this could include malicious content. The previous arguments and security measures they have put into place, however, should be a good case as to why there is no known malware for Windows Phone 7 devices. I also did not list all of the security features as there are several more but this should be sufficient in explaining why Windows Phone 7 isn't currently threatened by malware.

share|improve this answer
    
This answer could be improved by removing the subjective opinion. Eg replace "It is highly doubtful. Win..." with "I have not seen any. One reason malware hasn't been found targeting Windows Phone 7 is because Win...". Remove the guessing. I'm guessing :-) it is the tone of the answer that is causing the downvotes. Stackechange promotes answers with specific facts, not opinions - and security geeks are particularly sensitive to opinions saying hacks will never occur (we've been proved wrong too many times). –  Duncan Oct 26 '12 at 12:27
    
@Duncan It's interesting that a blatantly wrong answer gets 2 up votes and one that was completely valid gets 5 down votes. I elaborated on my answer by basically saying everything I already said in a much more drawn out fashion. I'm glad that the Security forum on this site has such an understanding community to new comers. I think I'll stick to the more friendly Q&A parts of this site from now on. Thanks for giving helpful input though instead of just down voting with no explanation. –  Tony Nov 15 '12 at 17:42
    
@Tony I +1'd this simply because you made a significant effort in trying to be constructive not to mention the quantity of downvotes is unfair in my opinion. I'll encourage you to continue the Stack Overflow sites, since you may learn that over time it helps with your technical writing. It helped me. see this related link –  makerofthings7 Nov 16 '12 at 19:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.