The latest product for mobile security from Symantec is an antivirus for handheld computers. Since I've been emphasising security in our newsletters, it's an appropriate time to review this product.
How important is security on mobile devices? This issue has been discussed at length in the last few months, with reports of misplaced portable devices revealing secret or sensitive information, remote access to private networks information stored and granted to devices (using Terminal Services or VNC for instance).
What about malware? Virus and trojans are common in the dekstop world, and so far very little have been reported of this kind of software being released in the wild. There's no reports of virus or trojans on the Pocket PC world, but there are three different strains for the Palm OS environment (virus reference for more information on Palm.Liberty.A, Palm.Phage.Dropper and Palm.Vapor).
Virus and trojans can be transferred to a device via infrared, Bluetooth, Hotsync or ActiveSync from another handheld or host computer. In these days it pays to be cautious.
There are a few anti-virus software for handhelds in the market (including a free limited offer from Computer Associates), but few carry the fame and name of Symantec Antivirus.
I've first seen the Symantec Antivirus for Handhelds as an add-on with the Symantec Norton Internet Security Professional Edition 2002. At that time it was bundled with the NIS package (including the firewall, desktop antivirus and Palm OS antivirus). Now Symantec launched this product on its own, including a version for Pocket PC.
There are different versions of this software available. The box I received for review is the Home and Small Office version, called Annual Service Edition. The CD includes both Palm OS and Pocket PC versions. The other versions are for corporate world, with centralised configuration, deployment and reporting.
After installation the user is guided through the download of updated virus definitions, and installation on the handheld. The installation program will identify the Palm Hotsync and Microsoft ActiveSync softwares and install the appropriate conduit.
From the desktop control program the user can have a current status update and reinstall the software on the mobile device.
Desktop program showing status of current installation
As other versions of this software (for Microsoft Windows and Apple Mac OS), this software comes with an annual subscription, giving the users access to the LiveUpdate server where downloads with new virus definitions are available. The desktop based LiveUpdate can be configured to connect to the server on a scheduled basis, or on user request. When the device is synchronised the updates will be transferred. There's an option of doing the update directly from the mobile device, and we'll see it later.
Microsoft ActiveSync with LiveUpdate conduit
Once the software is installed on a Pocket PC and started a new icon is added to the status bar, and it'll restart even after a soft reset.
Access to Symantec Antivirus on Pocket PC
With Auto Protect active, the program will scan files as they're moved and copied within the device's memory.
Because there is no current known virus or trojans for Pocket PC, the only signature available is for the EICAR test file. This file contains a string that identifies it as a virus, intended to be a test file. All antivirus programs have to identify this as a virus (even though it does nothing). The file can be downloaded from the EICAR official website. Update: The Symantec Antivirus was updated since the original article was published, and it now includes definitions for WinCE.Duts.A and WinCE.Brador.a
To test the program I tried copying the EICAR test file to the handheld, through ActiveSync. The software correctly identified the file and asked for an action from me. I allowed the file to be copied so I could run a scan. The scan was extremely fast, on a iPaq H3970 with Windows Mobile 2003.
If the user is away from the desktop it is still possible to update virus definitions, if an internet connection (via mobile or wireless network) is available. The LiveUpdate handheld version works over these connections too:
Although the real threat of virus for handheld devices seem to be on the Palm OS side for now, there's always the possibility of these malware being developed and released for other platforms. The simply act of beaming a game file via infrared or Bluetooth can be the vector for one of these programs. And there's always the chance of a virus on the desktop being developed to identify handheld connections and prograting from there. I've seen screenshots of Windows Longhorn where mobile devices were treated as part of the system, increasing the risk.
I recommend the software to give users the peace of mind and to be proactive if anything happens - and it'll.
The only problem is the recommended price in New Zealand is NZ$89.95 (in the United States US$49.95), which is a little higher than mobile users are used to pay for software. But this is around the price for other similar antivirus softwares available.