Suppose my computer is compromised or has malware. Can the malware spread to my phone? If so, how? Has any malware been observed in the wild to do this?

Relevance: Some banks use two-factor authentication of online banking transactions; when you want to make a transaction, they send a confirmation code to your phone, and then you need to enter it into the web site to confirm. This is intended to protect against fraud by malware on the customer's computer, but if malware can spread from your computer to your phone, this protection looks less effective. Also, a number of web sites have started to use two-factor authentication, and they would be affected similarly.

Related: Can a compromised mobile phone be used to penetrate a desktop or server? asks about the reverse scenario.

  • Interesting question for research. As malware may spread to USB sticks, this has probably happened on cellphones or will. Commented Oct 17, 2012 at 16:26
  • If your mobile runs windows xp, than definitely yes. In any other case, the update process is quite OK, but making some jpeg which runs shellcode from the photofolder is just a matter of time. Anyway, cross-platform ways are very rare, and running exploits from mobiles against pcs seems difficult, because you cant compile it just like that on iphone, you need to download it and bypass protections. Commented Oct 19, 2012 at 1:55

3 Answers 3


There is no reason why malware cannot spread from any kind of device to any kind of device, it all depends on how the malware has been developed. AFAIK there is no malware known that infects both PCs and mobiles at this point, but there's no reason it can't be done. Possible vectors are:

  1. infected music files: a malware infected music file could be spread to a mobile during some sort of sync, like an itunes sync
  2. Over the network: mobiles are often connected to wireless networks, malware could be designed to use vulnerabilities in mobile OSs to infect them
  3. Over a USB connection: when you connect your mobile to your computer communication is possible between the 2 devices, and communications path is a possible malware infection vector
  4. Bluetooth

Of course there are other ways a mobile could be infected (phishing, infected emails, etc), but they are not a direct spread from a computer to a mobile.


It is entirely possible, although I don't think it has happened as of yet.

The jailbreaks against iOS (like Redsn0w) work by tethering the device to your desktop. Although this is not quite as simple as just plugging your phone into your computer, It is pretty close. Attack surface is exposed by a device that is plugged into a computer.

Charline Miller's NFC attacks are promising. One of his attacks against Nokia phones allows him to mount the file system over bluetooth. Although no PC has NFC, most have bluetooth.

Really the most likely attack would be something like Chrome to Phone to deliver a browser based exploit. The browser is still the largest attack surface on a mobile device.

  • It somewhat has happened, but not with malware. There's a site that remotely jailbreaks iPhones via a kernel remote code execution vulnerability. Just a one-click process and it does the whole thing over the net. Part of the process involves uploading new binaries, so it could certainly be considered a close analogue of a real attack. Considering we can also do this via tethering, as you mentioned, it's pretty much a done deal.
    – Polynomial
    Commented Oct 18, 2012 at 8:49
  • @Polynomial that happened! It delivered a remote code execution exploit via a PDF and then jailbroke the iphone. Crazy stuff.
    – rook
    Commented Oct 18, 2012 at 15:17
  • Haha, that's nuts. I knew there was a valid reason why I don't put anything of importance on my phone...
    – Polynomial
    Commented Oct 18, 2012 at 15:31

Some mobile phone users "sync" their device with their PC/Mac (that's how you can transfer music files from the PC to the phone, at least) and the sync feature tends to include everything that is not the base OS (in particular apps). Therefore, there is a privileged transmission channel from the PC to the phone. Assuming the existence of a "malware app", it would be trivial for an infected PC to add the app in the list of to-be-synced apps. The same transmission channel could be used to transfer specially crafted files to exploit security holes in the phone (and this one assumes the existence of such holes, of course).

If we are to believe Apple's/Google's marketing, the apps are signed and this, supposedly (and somewhat magically) prevents the apps from being malicious. I am not totally buying this, though. I am ready to admit that an evil app will be eventually removed (e.g. with some certificate revocation), but I don't believe that it will be done promptly (it would take a few days, at least).

One might note that when a device is jailbroken and the app signature system deactivated, then the vulnerability is noticeably increased.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .