The Lookout Blog

Malware from Computers Spreading Through Smartphones

A recent report by Panda Security found that 25 percent of new worms in 2010 were designed to spread via USB storage devices connected to computers. We, at Lookout, have observed that the types of viruses spread through USB or storage devices can also spread via smartphones. As a result, we have taken steps to protect against this propagation.

Phones are often overlooked as a type of storage device.  In fact, any device that can store information (external hard drive, flash drive, MP3 Player or even DVD player) can carry a virus without the user’s knowledge.  Because phones hold a lot of information, they too, are susceptible to acting as a “carrier” and transferring viruses from one computer to another. From what we’ve seen so far, the PC malware doesn’t directly put your phone at risk. It is the carrier, but because it was written for PC’s, smartphones seem to be immune from these viruses.

How it happens: When someone plugs their smartphone into a computer that has been infected with a virus, the virus can be transferred onto the smartphone and then act as the carrier to infect any other computer to which the phone connects. So, for example, if your home PC has a virus and you connect your smartphone to it, and then bring your phone to work and connect to your work PC, you have just infected your work PC with that same virus.

Some examples of PC viruses we’ve seen on smartphones include the Mariposa botnet that was discovered to be preloaded on Vodaphone Android phones earlier this year as well as instances of the PC virus Win32/Hamweq.A.

1. Only connect your phone to a computer that you trust. For example, if you are on a public computer at a library, internet café or airport kiosk, avoid connecting your phone to the computer.
2. If you need to use your computer to charge your phone, pay attention to the settings to ensure that you do not activate the phone to act as a “USB device.”
3. Have up to date security software running on your computer. Consider downloading security software for your smartphone as well. We’re partial to Lookout, and it currently warns users of any autorun files that exist on your phone.

If you think this has happened to you, contact us at security-at-mylookout.com and tell us about it.