Kaspersky Lab, a leading developer of secure content management solutions, announces that the first malicious program classified as a Trojan-SMS has been detected for smartphones running on Google’s Android operating system. Named Trojan-SMS.AndroidOS.FakePlayer.a, it has already infected a number of mobile devices.

The new malicious program penetrates smartphones running Android in the guise of a harmless media player application. Users are prompted to install a file of just over 13 KB with the standard Android extension .APK. Once installed on the phone, the Trojan uses the system to begin sending SMSs to premium rate numbers without the owner’s knowledge or consent, resulting in money passing from a user’s account to that of the cybercriminals.

The Trojan-SMS category is currently the most widespread class of malware for mobile phones, but Trojan-SMS.AndroidOS.FakePlayer.a is the first to specifically target the Android platform. It should be noted that there have already been isolated cases of devices running Android being infected with spyware. The first such program appeared in 2009.

“The IT market research and analysis organization IDC has noted that those selling devices running Android are experiencing the highest growth in sales among smartphone manufacturers. As a result, we can expect to see a corresponding rise in the amount of malware targeting that platform,” says Denis Maslennikov, Mobile Research Group Manager at Kaspersky Lab. “Kaspersky Lab is actively developing technologies and solutions to protect this operating system and plans to release Kaspersky Mobile Security for Android in early 2011.”

Kaspersky Lab recommends that users pay close attention to the services that an application requests access to when it is being installed. That includes access to premium rate services that charge to send SMSs and make calls. When a user agrees to these functions during the installation of an application, the smartphone may then be able to make calls and send SMSs without further authorization.

The signature for Trojan-SMS.AndroidOS.FakePlayer.a has already been added to Kaspersky Lab’s antivirus databases.

Some of the capabilities of AT&T Encryption Services include e-mail confidentiality to help prevent unauthorized parties from accessing critical messages and attachments, authentication of the e-mail sender, as well as non-repudiation: a validation of the integrity of the e-mail message and its contents that ensures the recipient that the message was not modified.

The AT&T Encryption Services portfolio has additional features including:

• Encrypted Mail: Developed to encrypt e-mail messages and attachments on the personal computer, this offer supports Outlook, Lotus Notes, Outlook Express, BlackBerry and Webmail.
• Encrypted Mail Gateway: An enterprise policy-management filter transparently determines whether e-mail should be encrypted. It features industry-trusted encryption standards such as PKI, X.509 and S/MIME and includes a message-pickup center for nonsubscribers.
• Encrypted Mail Exchange: This enables businesses to establish groups within a message-exchange platform, which provides full encryption services for e-mail and e-mail attachments.
• Encrypted Documents: This feature establishes the secure exchange of sensitive information between an individual and a user group by encrypting folder or network drives and all of the data contained within them.
• Encrypted Document Delivery: This offer provides the functionality to replace regular postal communications used for statements, invoices and notices with secure, signed and trusted e-mail messages and statement notifications.

AT&T’s managed security services portfolio is centered on the principles of delivering and leading the market with in-the-cloud security solutions to help enterprises reduce costs and remove the dependency on hardware and software. AT&T’s strategy for security is to provide a “defense in depth” approach to security, with features built into the various network layers, applications and supporting processes. More information on AT&T security offerings can be found at www.business.att.com/enterprise/Portfolio/eb_security/. 

“With the rise in popularity of Symbian OS handhelds for enterprise use, it is critical for companies to be able to centrally control, back up and secure these devices used by mobile workers,” said Joe Owen, vice president of engineering, Sybase iAnywhere. “Our customers are excited that we are bringing the same managed security approach to Symbian devices as we provide on other platforms, which allows IT to enforce important security policies such as enforced power-on password and device lockdown.”

Security capabilities for Symbian OS v9 include:

• Enforced Power-On password
• Administrator defined password format requirements
• Password expiration
• Device lockdown after exceeding allowed password attempts

Mobile management capabilities for Symbian OS v9 include:

• OTA software distribution
• Data backup and restore
• Hardware and software inventory collection
• Software license management
• Custom scripting component for automating electronic file distribution, file and directory management, program execution and notifications.

Anywhere Symbian support for Afaria is expected to be available in June 2008.

With this latest launch of its Mobile Security product, F-Secure now provides a complete security suite with firewall, antivirus and antispyware functionality for all the main mobile platforms running an open operating system: Windows Mobile, Symbian and UIQ. F-Secure Mobile Security can be subscribed from selected mobile operators as a service, purchased directly from the F-Secure eStore at: http://www.f-secure.com/estore or bought from resellers worldwide. The product will be available during the second quarter.

The list of supported devices is constantly expanding and consists today of over 150 smartphones. The up-to-date information can always be found from the mobile-device optimized F-Secure Mobile Portal under http://mobile.f-secure.com.