PDA Virus Protection Emerges

Crafting Small but Mighty Antivirus Apps

Like their counterparts on the desktop, the products from Symantec and F-Secure work by using a database of known virus signatures that is stored on the device itself. That method works fine today, because the number of known viruses for handhelds is so small. But if the number of viruses was to increase sharply--some 50,000 known desktop viruses exist--then the applications will become too bloated for the devices they sit on.

Finjan Software has one possible answer. Rather than scan for particular viruses, the company's software examines code for types of behavior. If a malicious program attempts to delete a file or open a network connection, for example, the software blocks the behavior and alerts the user.

Finjan is developing an antivirus product for Palm and Microsoft Pocket PC devices that uses this method, although it doesn't expect to release the product before the end of the year. Next month, however, it plans to release a kind of interim product similar to VirusScan, says Dave Kroll, Finjan's director of marketing.

Calling for a Combination

McAfee, Symantec, F-Secure, and Trend Micro all say they expect that a hybrid solution--one combining behavior monitoring and scanning for known viruses--will work best. Trend Micro also advocates a server-based approach. The company is developing WAP gateway software that will scan files for malicious code before they are distributed. This approach may be increasingly important as people start to access e-mail, voice mail, and Web content from a single device, says David Lu, vice president of product business development at Trend Micro.

To a large extent, antivirus vendors are at the mercy of device makers, analysts say. As Microsoft and Palm expand the functionality of their devices by including support for features such as e-mail attachments, for example, then virus writers will be equipped with more tools to do their work.

"It's possible to prevent these vulnerabilities, but if doing so interferes with what developers feel they need in terms of features, then the features will come first and the security will come second," says Charles Kolodgy, a research manager for Internet security at IDC.