PDA virus found in the wild

Antivirus companies have been warning for years that viruses will afflict handheld devices, and the day has apparently arrived: Both Symantec and Kaspersky Labs have detected a backdoor Trojan horse program that can give an attacker complete control over a Pocket PC mobile device.

What's more, the antivirus firms don't have quick cures for PDA viruses similar to the data definitions they update for PCs when new viruses surface. Symantec and other antivirus companies do offer antivirus applications for mobile devices; the companies have previously tested such tools against viruses in the lab, such as the Dust virus developed last month.

But for systems infected with the so-called Brador virus, antivirus vendor Symantec recommends deleting the /Windows/StartUp/svchost.exe file in the Windows CE operating system and completely reinstalling the OS and applications.

"It's one of the first backdoor Trojans we've seen for Windows CE," says Oliver Friedrichs, senior manager with Symantec Security Response. "It's not really widespread. We've only seen one instance at this point. But it does show where attackers are going."

In Through a Backdoor

Symantec calls the virus Backdoor.Brador.A; Kaspersky Labs, which also issued an alert, dubs it Backdoor.WinCE.Brador.a. The pest is 5632 bytes in size, so it can easily spread through e-mail or as a download from a Web site to a personal digital assistant. Kaspersky Labs suspects that Brador was written by a Russian coder since it was discovered in an e-mail with Russian text.

Once Brador runs, it copies itself to the svchost.exe file in the Windows autorun folder and seizes control over the system after a restart. "It would give them total control if it got on," says Phebe Waterfield, a Yankee Group security solutions and services analyst.

"It e-mails the attacker your IP address," says Symantec's Friedrichs. "The attacker can then connect back, access the backdoor, look at your files, download the files, or even upload other malicious code."

Because of the limited nature of Brador's dissemination, Symantec gave it a threat level of 1 (on a scale from 1 to 5, with 5 being the greatest). "It's not going to spread itself," Waterfield says. "But it's setting a very scary precedent. It's fulfilling a prediction that the security folks have had for a long time--that the threats on desktops are going to spread to these kinds of devices."

Precautions and Fixes

The big problem is that Windows CE and other operating systems for PDAs don't have the security capabilities of Windows XP, Waterfield says.

"The latest version--Windows CE.Net--does have more of these features, but with older PDAs you couldn't even set permissions within the device. Any data, or even passwords, could be exposed by this Trojan," she says.

Any mobile device based on the ARM processor is vulnerable to Brador, so Friedrichs recommends taking care when receiving files.

"Be careful you don't download anything or read e-mail that may contain a backdoor Trojan, for example, an executable file," he says. "Make sure you trust the source, and the file has been authenticated."

Waterfield also suggests that corporations create usage policies for their employees with mobile devices. "Make sure they're using password protection. Don't download any untrusted code. Run some antivirus software. And keep very sensitive information off of the device altogether," she says.

Those words of advice were echoed at the recent Black Hat Briefings in Las Vegas, where security experts warned that PDAs, cell phones, and other mobile devices are the next big target of virus writers.

The antivirus vendors say they are continuing to refine PDA antivirus applications.

Brador is "one sample of what we're really expecting to be a growing trend in terms of mobile computing and mobile devices because their functionality is becoming closer to a PC," Friedrichs says. "It brings the same attacks you see on the home PC right down to the mobile device."

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Joel Strauch

PC World
Show Comments

Cool Tech

D-Link PowerLine AV2 2000 Gigabit Network Kit

Learn more >

ASUS ROG Swift PG279Q – Reign beyond virtual world

Learn more >

D-Link TAIPAN AC3200 Ultra Wi-Fi Modem Router (DSL-4320L)

Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Crucial® BX200 SATA 2.5” 7mm (with 9.5mm adapter) Internal Solid State Drive

Learn more >

Gadgets & Things

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >


Learn more >

Family Friendly

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

ASUS VivoPC VM62 - Incredibly Powerful, Unbelievably Small

Learn more >

Stocking Stuffer

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Best Deals on PC World


Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.


Latest Jobs


Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?