Malicious code targets Palm users

The discovery of malicious code affecting Palm devices has shown that handhelds as well as PCs are potentially vulnerable to virus infection.

The Trojan horse program, called Palm.Liberty.A, which can delete applications and databases from users' Palm devices, is disguised as a tool for people who want to obtain pirate copies of Liberty, the Nintendo GameBoy emulator program for the Palm platform.

The bug will affect any Palm device on which it is installed even if data is re-synchronised with a user's PC.

But antivirus experts said that the Trojan is not spreading and does not represent a significant threat to users, particularly those that are sensible enough to avoid pirate software sites.

Most antivirus packages have been updated to detect the virus on a user's PC before the malicious application is synchronised to the Palm device.

Eric Chien, head of Symantec's Antivirus Research Centre, said: "Whilst no users have reported being infected, this signifies the latest development for devices outside of the PC being under attack. The Palm platforms and all [personal digital assistants] have long been criticised for their lack of security as they are running on processors that do not support security features."

He added that the Trojan is best viewed as a "proof of concept", but said that security problems affecting handhelds can only be expected to increase as these devices become more connected.

The Trojan originated in Sweden and was written by Aaron Ardiri, the co-author of Liberty.

Ardiri has admitted writing the malicious code and giving it to "a few friends", and it is widely believed that one of these people posted it during an Internet Relay Chat session. It may now be present on sites and newsgroups popular with the pirated software community.

Graham Cluley, senior technology consultant at antivirus vendor Sophos, said: "This is a very low threat to Palm users who are sensible enough to avoid pirated software mailing lists and do not download pirated software."

Cluley added that a malicious program capable of self-replication on a mobile platform had yet to be discovered.