News Feature

Spy Software Co. Says Product Isn't a Trojan

March 31, 2006 — CIO —

The company selling a mobile-phone spy application that has been labeled malware by F-Secure says the software isn’t malicious or illegal.

F-Secure software recently began blocking a commercial application called FlexiSpy that bills itself as the world’s first spy software built for mobile phones.

When FlexiSpy software is loaded onto a Symbian mobile phone, it sends all text messages that are sent and received, as well as call details, to FlexiSpy servers. Users can log on to the servers via the Internet to read the messages and view the call records. The problem, says F-Secure, is that the phone owner may not know the program has been installed and can’t uninstall it.

"We’re convinced that this could be used for malicious and illegal purposes in so many ways that we made the decision to flag it as malware," said Mikko Hypponen, F-Secure’s chief research officer.

Vervata, the Bangkok, Thailand, company that created FlexiSpy, argues that the product isn’t a virus, a Trojan horse or malware.

"Like any other monitoring software there may be a possibility for misuse, but there is nothing inherent in FlexiSpy that makes it illegal or malicious," a Vervata spokesman wrote in an e-mail exchange. He said the software must be consciously installed by a person, does not self-replicate and doesn’t pretend to be something it’s not.

He said that an uninstall option is provided so the user can uninstall the program at any time, but F-Secure found that the application uninstaller doesn’t work.

Hypponen also worried that a user could "beam" the program via Bluetooth to other nearby users. "If one in 100 people who received it wonders what it is and clicks on it, it would install without telling the user what the program does," he said. Going forward, the person who sent the program could read that person’s text messages online. "If that’s not malicious, I don’t know what is," Hypponen said.

Some changes to the program could make it more palatable, he said. For instance, if the installation process clearly shows that a spy program is being installed, it could be useful for parents who might want to monitor a child’s text messages, he said.

But using this type of program to spy on another person is illegal in most parts of the world, he noted. In addition, he also said that users might be concerned that the text messages and calling information are being stored on Vervata servers.

F-Secure has contacted Vervata to discuss the program but hasn’t received a response, Hypponen said.

1 | 2 |next page »

Comments

Share [+]

TOOLS

Comments

Digg This

SlashDot

CENTER OF EXCELLENCE

Security

» Prudential Financial Protects its Brand with Symantec Data Loss Prevention Solutions
FORTUNE 100 insurance leaders rely on the Symantec Data Loss Prevention solution to protect sensitive customer data.

» Information Security: Data Drains and How to Prevent Loss
Do you know where your confidential data is, where it is going, and how to prevent it from leaving your organization.

» Data Loss Prevention: Keeping Sensitive Data Out of the Wrong Hands
Learn what the thought-leaders at PricewaterhouseCoopers have to say on the risks associated with data security.

» 7 Requirements of Data Loss Prevention
Incorporate best practices from many companies using DLP solutions as you establish your organization's requirements and safeguard confidential data.

» Ponemon Study: How Much Does a Data Breach "Cost"?
35 U.S. organizations that lost confidential information and had a regulatory requirement to publicly notify affected individuals are studied in this report.

Center sponsored by