The full report can be accessed at: http://www.viruslist.com/en/analysis?pubid=201225789 .

Written by Aleks Gostev, Senior Virus Analyst at Kaspersky Lab, the report examines the impact of vulnerabilities within Windows CE and Symbian mobile operating systems on the evolution of mobile malware.  The report shows that nearly all the major virus epidemics over the fast few years have been caused by vulnerabilities in Windows and Gostev points out that there are only two ways for remote malicious users to penetrate a potential victim’s system: by exploiting the human factor through social engineering; or by exploiting software coding errors.  These same principles apply to mobile devices.

According to the report, Windows CE is extremely vulnerable.  There are no restrictions on executable applications and their processes; once launched, a program can gain full access to any operating system function such as receiving or transmitting files, and phone and multimedia functions.  “Creating applications for Windows CE is easy,” says Gostev. 

Currently, there are only four virus families targeting Windows CE, but Gostev says that the potential of the operating system as an environment for malicious code should not be underestimated:  “The viruses currently in existence represent all the most dangerous types of malicious program – classic file viruses, email worms, backdoors and worms which are capable of moving from a handset to a desktop PC once connected to it.  Platforms based on Windows CE are growing in popularity and in a few years they may come to take the market share of mobile device operating systems, squeezing out Symbian.”

The report finds that Symbian is a more closed system than Windows CE, as it is harder (and more expensive) to create applications for it.  However, the architecture of Symbian Series 60 contains a range of “serious errors” that expose it to attack.  Symbian allows any system application to be rewritten without explicit user consent; and some file formats mean the system can become unstable and reboot itself.  “The level of application security is very similar to that of Windows CE – in other words, it doesn’t exist,” says Gostev. “Once an application has penetrated the system, it can take total control of all functions of the phone.”