Smartphone security: what you need to know

Late last year, alarming reports surfaced that Ralf-Philipp Weinmann, a researcher at the Luxembourg University Laboratory of Cryptology and Security, had discovered a way to completely compromise unprotected smartphones. Demonstrating his hack at the Vienna DeepSec conference, he showed how he could listen to conversations, intercept data, and run up huge bills calling and texting premium rate services – all without the alerting the phone's owner.With the ability to download and run apps, smartphones are now the main focus for a growing number of malicious hackers, and yet most devices are completely unprotected. For online criminals, the situation resembles that of PCs in the mid-1990s, except they now know how much money there is to be made from online crime.Thanks to the deepest recession in living memory, straightforward theft and street muggings for smartphones are also at an all time high, so how do you protect your freedom to compute on the move? Passwords first Most people would never dream of using something as obvious as 1234 as the password to their important online accounts, but some will protect their smartphones with such a sequence and leave the online accounts it protects logged in for convenience.Your first line of mobile defence should always be to select a password that's both memorable for you and difficult for a thief to crack. For a few years now, the best advice on creating memorable and secure passwords has been to take the initial letters of a line in a song, poem, play or book, and to make a password from those letters. You can test the strength of passwords you generate in this way using free online web security site services like How Big is Your Haystack at grc.com/haystack.htm.As of version 2.2, Android OS supports not only gesture passwords, but also the more traditional text-based variety. To enable a password, click 'Menu > Settings > Location and security > Screen unlock'. Also set the screen's timeout to a short period by clicking 'Menu > Settings > Display'.You can combine a password with gesture recognition, but always ensure that you use a gesture that overlaps itself, otherwise the grease marks on the screen may give it away to anyone who steals your phone. It's also a good idea to clean the screen every so often to prevent grit from scratching the gesture faintly into the screen's surface.To enable passwords, iPhone users should open the Settings app and select 'General > Passcode lock'. Windows Phone 7 users should tap 'Settings > Lock and wallpaper', and BlackBerry users need to select 'Options > Security options > General settings'.You'd never buy a laptop and go online without installing at least a free antivirus product. The abilities of a smartphone or tablet computer are now approaching those of a laptop, but it seems that the vast majority of users have no form of protection, even though mobile computing devices are facing all the usual threats.Spam containing malware attachments or links to attack sites, infected apps and code that exploit OS weaknesses are all starting to appear. Botnets made up of mobile devices are also becoming more common.We've reached the point in the evolution of mobile computing where it has become just as necessary to install antivirus software on your phone as it is on every other online computing device. Most antivirus vendors now offer free versions of their commercial mobile offerings, and many offer handy package deals on their commercial versions, including protection for multiple PCs and a phone, for a yearly subscription.It's worth investigating these deals because they could save you money in the long run, but what's the difference between free and commercial versions? Mostly, the difference is down to the facilities provided beyond basic protection. The ability to remotely wipe a lost or stolen phone, for example, is something that will give you real peace of mind, but it's usually missing from the free versions of antivirus products.Never be tempted to simply click a link that looks okay and install what purports to be a free version of an antivirus package. Check the URL; if it isn't part of a vendor's official website, don't visit the page. Fake antivirus software, written to infect your device or make you think it's protected when it's not, has now made its way to smartphones. If you've found a package on an app store, click through to the software vendor's website and download it from there.Remote wipe.So you have a secure password guarding immediate access to your phone, the screen lock activates after just a few minutes of inactivity and an antivirus package is watching out for malware in the background. However, if the worst happens and someone takes your smartphone either by stealth or by force, you may also want to protect your data by wiping files and contacts quickly and remotely. Android, BlackBerry and Windows Phone users have a range of third-party, dedicated remote wipe applications to choose from, which enable you to contact the phone and have it wipe itself. These tend to be subscription services, but prices are usually less than £5 a month, which is good value for extra peace of mind.Alternatively, you can examine the facilities offered by different antivirus packages. Free versions, like AVG's Mobilation Free, offer local wipe facilities. However, it's not always clear if remote wipe is included or just a local wipe facility, so check with the software vendor before you part with your cash.