The future of mobile malware - digitally signed by Symbian?

TalkBack 1 of 3:

Next »

• Thread View
• Flat View

Signed is not the same as safe

As this incident clearly shows, signing of applications is not a guarantee of safety. A digital signature tells you that program has not been tampered with since it was signed and who signed it. It does not tell you that the creator had your best interests at heart nor does it tell you that the signer knows every byte of the application and what it will do. In the case of Symbian Signed applications there is also a security check but no check is perfect. Even if every application was checked by a human researcher mistakes would still happen. Humans are, after all, human.
As my colleague at Sophos, Paul Ducklin, wrote strong authentication cannot eliminate fraud. http://www.sophos.com/security/technical-papers/phishing-and-fraud.pdf
Signing is an identification technology, not a guarantee of security.

Posted by: richardwang   Posted on: 07/23/09 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now
• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now
• Reducing Server Total Cost of Ownership with VMware Virtualization Software VMware VMware virtualization enables customers to reduce their server TCO and ... Download Now