Thanks to the Carnival of Mobilists and more importantly the great analysis from Tomi Ahonen I learnt where the original Nokia tune is from. I'm not a tune-addict, still I can't stop listening to this one. Enjoy!
Tote
Who am I?
Software architect working in Symbian/S60 area since 2000 and still being enthusiastic about mobility. Please visit my introduction page on Forum Nokia Champions web page.
Calendar
Recently...
Categories
- Qt [1]
- Operators [1]
- Mobile Monday [1]
- Market [4]
- Security [3]
- Open Source [1]
- Palm [2]
- Mobile Monday [4]
- Symbian Foundation [5]
- Nokia [11]
- Android [16]
- Linux [6]
- Development [14]
- Innovation [1]
- Symbian [22]
- Windows Mobile [11]
- Platform Security [2]
- iPhone [19]
- UI [2]
- Mobile OS [16]
- Testing [3]
- Symbian C++ [11]
- Series 80 [0]
- Series 40 [0]
- S60 [14]
- Python [0]
- Open C [1]
- Messaging [0]
- Location Based Services [1]
- Java [3]
- General [17]
- Games [0]
- Flash [1]
- Event [5]
- Entertainment [0]
- Enterprise [4]
- Connectivity [2]
- CDMA [0]
- Business Opportunities/Services [22]
- Browsing [5]
Gabor Torok's Forum Nokia Blog
On Google's move in navigation
tote_b5 | 05 November, 2009 02:37
It's been announced a couple of days ago that turn-by-turn GPS navigation would be supported soon on devices based on Android 2.0 platform. Free of charge. The new Google Maps Navigation offers free turn-by-turn navigation garnished with Google's core business (search by voice and in plain English, search along route) and existing services (traffic, satellite and street views) for Android devices.
I was shocked to hear this news. The two biggest map data providers, Tele Atlas and Navteq, have been acquired a few years ago, former for $2.9bn by TomTom latter for $8.1bn by Nokia. Their main revenue sources were licensed map data and value added services e.g. turn-by-turn navigation. Since Google uses either its own map data or one that is freely available, I think I told everything: they do whatever they want. It is still unknown how Google will monetize on the new service - other than ruining competitors -, but advertisement seems to be a very likely option.
On a related note, I found Bill Gurley's article on Less than free business model quite interesting. Briefly, Google offers Android to OEMs free of royalty, even more, they pay ad split to them. In other words, it's not only that OEMs don't have to pay, but on the contrary, they will get paid. One of the commenters of this article gave a hint on another business model that Google may try to follow: don't bother with ads, but offer a package to navigation device makers, news agencies, automakers, roadside advertisers, etc. A package that is based on continuously updated traffic data that can be used to provide always optimal routing information.
How can competitors react on Google's move? Without own map data it's very difficult to compete with someone who's giving away the same service that we are selling.
- Stefan from IntoMobile suggested that Nokia should make map data free and wait for the flood of new mapping services - let's see what innovation will result in. Not a bad idea, but would leave Nokia in a bit of passive role, wouldn't it?
- The other option could be to do the same as Google may do in the future: sell a package instead of showing ads (see above). Why Nokia? Because it has maps data. Which platform? It's rather Maemo than Symbian - we're talking not only about mobile phones, but other embedded devices, too.
- Finally, the third option is advertising and provide free service. Who? Microsoft doesn't have own map data, but has Bing and Yahoo! search, which is a good basis for advertising. Whereas Nokia doesn't have search, but has maps data (I told you that Nokia should have bought Yahoo!). Perhaps these companies should form an alliance?
Looking forward to your comments,
Tote
Business Opportunities/Services, Mobile OS, Windows Mobile, Symbian, Android, Nokia, Market |
Permalink |
Comments (1) |
Trackbacks (0)
Enterprise Mobility Development
tote_b5 | 28 October, 2009 23:06
Some of you might have read one of my previous posts in which I wrote that I had had to choose between mobile and enterprise development mostly for personal reasons. I was sorry to realize this because mobile is my passion, but I thought the change was inevitable. Now I don't.
It's a cliche that the job market is much bigger for enterprise developers than for mobile devs. That was one of the main reasons why I had to change area, too - not as if I didn't enjoy enterprise as well. The interesting thing I've just come to realize that there's a gap between the boundaries of the two areas: it's for people with knowledge on both (otherwise huge) areas. The opportunity is great for both kinds of developers coming from either direction, because it offers a way to reach out even more people.
Now you understand why I read an article the other day with great interest: it described the required skill set for an enterprise mobility developer. First, it just confirmed that my theory was right: there's a need for such people. Second, let me add some more points to the list provided. I could have extended the list on the original blog post, however, for that I should have had an account on that site which I was reluctant to create. Here's the list:
- Bandwidth: I think it was network what the author really meant. Bandwidth really is one of the characteristics that one needs to pay attention to, but it's also worth mentioning different types of networks (from 2G to 3.5G, WiFi, VPN, etc.), their main characteristics (e,g IP address re-assignments, frequent network outage), roaming, etc.
- Options for development: today's popular web development (very important to note that it's mostly applicable for smartphones only, thus not an option for the vast majority of mobile phones) vs native vs any other environments.
- Testing: never-ever forget that emulator/simulator is not the same as the real hardware. Peculiarities of various networks also count (quality, reliability, QoS, etc.).
- Option for cross-platform development: one company may target one platform at a time, however, it's also wise to plan ahead and build the foundation with the future in mind.
- Deployment, maintenance: app stores vs downloadable install packages from own site. Keeping enterprise service and mobile client versions in sync so that they're always fully inter-operable. Auto-update. Etc.
- Monetization, marketing: what I really mean here is making use of app stores as efficiently as possible. It's today's trend for mobile manufacturers to have their own stores and compete with carriers who would also like to monetize on this opportunity (by having their own stores). Sort of a war between vertical (manufacturers) and horizontal (carriers).
And I'm sure we've still missed a lot from the list. In any case, that was my two cents. :)
Tote
Enterprise, Mobile OS, Development, Market |
Permalink |
Add comment |
Trackbacks (0)
Smartphone OS market share - 2012
tote_b5 | 09 October, 2009 20:56
Yes, you read it right: it's 2012. Gartner published a report (link: Computerworld) in which they forecast the following smartphone OS market share for 2012:
We could all see the trend which players remain, disappear or gain strong foothold for a while by now. Nokia has always been the strongest when it comes to smartphones and they will be able to keep their position according to Gartner. They have a huge loyal user base and Nokia as an Internet company and phone manufacturer in one will probably be able to fight successfully against its competitors.
Apple has great technical innovations (form factor, made touch trendy with multitouch, etc.) in addition to the ability to sell (how easy it is to forget about this!). Their tight control on most parts of the mobile value chain is very different compared to what their competitors do, but it has proven to affect user experience in the right way and made this business very profitable for the company.
Google is a goliath in Internet business with huge influence on people's lives already. They use this power to become successful in mobile business with a great strategy: cost reduction for everyone, let it be manufacturers, network operators, developers, users, etc.
All these companies are able to make people passionate about their devices. The term, convergence, has been already accompanied with smartphones in the past few years, however, it's always been about integrating something into the device: MP3 player, FM radio, digital camera, GPS, etc. This time it's different: we're living the age of integrating the mobile phone into an even bigger thing, a cloud called Internet. It's no surprise why Google is successful with Android: people are already dependent on their services and they "only" had to provide the means for mobile users to access these services via their beloved gadgets.
It wouldn't be surprising if these figures became true by 2012. All the remaining players are less innovative (Palm Pre is a copy of iPhone), struggling with finding their identity (M$), are not offering a portfolio that is wide enough (BlackBerry is a business phone), etc. It might be worth noting that data communication will be dominant by 2012 and will drive the growth of MID
-market. Wonder if Gartner has reckoned with this, too.
-market. Wonder if Gartner has reckoned with this, too.Tote
Ps.: Google Chart API is our friend. :)
Mobile OS, iPhone, Symbian, Android |
Permalink |
Comments (4) |
Trackbacks (0)
Fate of Symbian C++
tote_b5 | 09 October, 2009 20:53
Historically, Symbian OS has evolved from EPOC, a mobile operating system written originally by Psion. The foundations were laid down in the 80's and a lot of work had been done to it while it became EPOC32 in the late 90's, the direct predecessor of Symbian OS. Also for historical reasons, the developers of Symbian decided to deviate from standard C and not-yet-standard C++ and create their own flavour of programming language. They thought their own exception mechanism (aka leaving), string handling (alias descriptors), naming conventions (C, M, R, T classes), etc. are better than anything else and make it the most appropriate tool to write an entire operating system and related frameworks for resource constrained devices.
They were probably right. But since it was a deviation from "normal" it was a question of time to turn out if people tolerate the difference. People, also known as developers. Through developers the whole market. Small and big players alike.
When Nokia acquired Trolltech speculation started. About Nokia's real reason, I mean. A lot of people didn't believe that it was "just" about making a common framework for smart- and feature phones + desktop computers. Personally, I thought it was a really valid reason alone, though naturally wondered how it would affect the future of Symbian.
People also speculated if not only will Nokia replace Avkon (the UI framework for Symbian S60) with Qt, but change from Symbian to Linux, too. Time has proven that it was not the case. Symbian OS was - and it still is - so valuable that it wouldn't have made sense to throw it out. Nokia has achieved so much with this operating system, put so much money in the development of it and most importantly the system has proven that it DOES work so that it is reliable, secure, can be customized, etc. It simply made sense to keep it.
The latest news about Qt vs Symbian C++ is that "Qt will take over the application layer on Symbian devices, among others, reducing Symbian development to under-the-hood core programming at best" (from El Reg). At best. So finally it seems the market (again, through developers) didn't tolerate the afore-mentioned deviation. Not as if developers didn't have a bunch of alternatives to develop for Symbian devices: Flash, web run-time, Java, Python, .NET, etc. Still, the programming language that offered the most freedom to developers has apparently failed to attract and keep the masses. It is now time to retreat in the wings.
In the closing words, let me chew upon how much marketing could have supported this programming language to become more popular. Take, for example, the "official" language of iPhone development: objective C. Is it a deviation from standard C? Yes. It's not even C++, if that counts at all. Is it easy to learn? Personally I didn't have the chance to study it, but my ex-colleagues did and they told me that it wasn't that difficult as they had anticipated. Admit that they had a decade of experience in mobile sw development that most people don't. What I'd like to point out, though, is that there are languages that are much easier to learn and use in practice, such as Java, Python and the likes. All in all, I think Obj-C is at least as much deviated from the standard as Symbian C++.
Then why is it so popular in contrast with Symbian C++? Perhaps it's because of the tools - compare the two emulators, for example. Or is it the processes - there are pros and cons on both sides: Symbian Signed has received much criticism, but Apple approval process is not much better, either. Or is it the hype that surrounds iPhone devices and related development environment that made developers to forget about the imperfection of this language? I think it's pretty much that case. What made the hype? Innovation and marketing, i.e. that Apple could find out something new and they could sell it, too.
Symbian C++ could have been saved with a bit more selling power, in my opinion. It is not going to disappear, just less apparent. And I don't cry for it, because I know it's called evolution. I just wonder what those years will be worth of that I had spent with it.
Tote
iPhone, Symbian, Development, Qt |
Permalink |
Comments (6) |
Trackbacks (0)
Change from mobile
tote_b5 | 13 July, 2009 23:34
To those who have been passionately reading my blog in the past and who may be wondering why I've been so silent lately. I wouldn't like to burden the readers with too much details. Follow this link if you're still interested.
Tote
General |
Permalink |
Comments (3) |
Trackbacks (0)
MoMoHu - Telco to Web by NSN
tote_b5 | 05 May, 2009 19:39
Damn, so many abbreviations, let me elaborate them.
Mobile Monday Hungary has had another round yesterday with Nokia Siemens Networks giving presentation about Telco to Web. The event was also hosted by NSN at a nice place at their premises.
After a brief introduction given by Robert Esik, there came the "real" presentation about the main topic presented by Said Berrahil. Said's presentation skills are really fascinating and it didn't take a minute to hear the first laughs from the audience.Funny, still serious, informative and thought-provoking. The whole presentation was built around the seven deadly sins, which the operators have committed so far. Don't take it that seriously, though: lust, gluttony, greed, sloth, wrath, envy and pride were all mentioned and with the obvious exception of lust some examples helped us understand what network operators did wrong.
Achievements were also mentioned, though! Since it's naturally not only bad things that operators have done so far. It's even more understandable that achievements were highlighted from a company whose main customers are the operators themselves, right? :) I found it a bit odd, though, that after talking so much about operators' business (don't forget that NSN is not an operator!) Said didn't talk too much about what they had been doing lately.
Finally there was a half an hour free Q&A session after the presentaion where people were really active to talk about the topic. I was surprised to see so many people (35-40) interested in such a not-so-popular topic and have heard lots of good and insightful comments.
Looking forward to the next event!
Tote, a co-organizer of MoMoHu
Mobile Monday, Operators |
Permalink |
Add comment |
Trackbacks (0)
The $1 business model
tote_b5 | 23 March, 2009 02:08
There are two kinds of developers: those who want to sell their programs and those who write software for fun and/or for fame. The latter type is happy with writing freeware, most probably open source software. This article is about the former.
- Would people be interested in the program?
- Would they be willing to pay for it?
- How much will they think the program is worth?
- What about competition, would our program fill a gap or it would just be one of the many?
- How can I sell my program, what distribution channels are available, what is the revenue share, etc?
- How much do I need to invest in writing the program financially, in terms of effort, etc.?
And the list is not over yet. But it contains the most important question from this article's point of view: how much is a program worth, how much can we ask for it? Note: the answers to these questions are not necessarily the same.
It is very difficult to foretell how much a program is worth for the users. The answer depends on so many factors, such as target group, their spending habits, type of software (e.g. leisure vs professional), what other programs with similar feature-set cost, etc. Naturally, price calculation is so often affected by that how much a developer appreciates his/her own software ("I put so many hours in creating it that it can't be cheap!") - and the expectations and the reality are not always in balance.
The available distribution channels also influence the final price: what they demand from the developer, what they offer to him, their revenue sharing model, etc. As to the latter, for example, although the 70-30 revenue share wasn't typical 1-2 years ago it is now becoming a standard. Apple's App Store, OHA's Android Market, Nokia's soon-to-be-opened Ovi Store all offer 70% off the revenue to the developer. Revenue share is not everything, though: for example, App Store is such a place where it's not uncommon to hear success stories and big earnings, whereas Android Market's community prefers free software. If you follow the news, you might have heard of the coming BlackBerry App World. I found it very interesting that they set the minimum price for a paid-for application to be $3. They said any software that is not worth this amount shall be freeware. I think it's ridiculous: these guys are not aware of how many developer they will alienate from themselves with this approach. Do they really want developers to sell BB apps or not?
The typical revenue models for developers are as follows:
- Release free application first with limited features and make it paid when it really gets traction (thousands, tens of thousand downloads per month). The application is available either for free or as paid-for (exclusive OR). Question: won't people turn away from your application once they have to pay for it?
- Write an always paid program, which means that your application must be really cool and advertised so well that despite the price (i.e. that it costs money) people buy it. Question: can you compete with free programs with similar features?
- Make a Lite and Pro version of your program, Lite being free and Pro paid. The free version supports a subset of Pro's features making it compelling enough to purchase the paid version. It is a very typical approach among developers. Notes: increased maintenance efforts + separation of free and paid-for features must be well thought-out.
- Free program with ads. Notes:
- Not all people like ads
- You need to find a good ad provider
- It is challenging to implement a good advertising solution on mobile devices, and there is no good framework available.
- Change model dynamically on an experimental basis: see if you can make it with paid version, if not then make it free, then make it paid again when it becomes popular (this is the path iStrip followed, actually). Question: when will people get bored with this behavior?
Please note that I did not include that model in the above list, where the client program is free, but it is essentially a light-weight interface to a server solution, which is exactly what your customers are paying for. Opera Mini's business model is based on this, for example: Opera Mini, the application, is available for anyone as a free download, however, it's Opera's customers (i.e network operators), who pay the price. This article is simply not about this model.
It's also worth noting how important user ratings have become recently. Some developers faced that ratings can kill: unhappy-uneducated users gave low ratings just because "game was too short", they "expected more", "it was free not too long ago", etc. Perhaps these users are not aware of how much power they have in their hands when they rate. Applications written for Android platform and distributed on Android Market are especially vulnerable to this effect.
Finally, getting closer to the point: how much can we ask for a program? Even though this habit is changing, it's still quite typical from people that they think that "cheap cannot be good" or "if it's good it can't be cheap". However, App Store's success stories have proven right the opposite: developers claimed that their revenue had become much higher when they lowered the price to $0.99. You know, this is such a low price that basically anyone can afford around the world even for the silliest program. Developers are now facing the fact that unless they sell their software at the lowest price there will be others who ask less than them. This basically forces them to sell their apps for $1 from the beginning.
Is it the final price, though? Can a $1 hit be sold for $2, too? No-one knows. It's all about making experiments. If I were to sell my app that I think is worth more than being distributed as a freeware, I would ask $1 for it. If people don't buy it at this low price, then I saved the hassle of price calibration. If it gets successful and my program is (one of) the best(s) in its category, then I would increase the price gradually until the download rate gets stabilized and I couldn't expect more revenue from making it even more expensive.
And actually this is what I call the $1 business model.
Looking forwad to your comments,
Tote
Business Opportunities/Services, iPhone, Symbian, Development, Android, Market |
Permalink |
Comments (3) |
Trackbacks (0)
Smartphone statistics, 2008
tote_b5 | 12 March, 2009 17:16
Gartner released their statistics about worldwide smartphone sales, which contains useful information not only the previous quarter (Q4 2008), but the whole past year. I'd like to share the following two figures with you:
Comments:
- Nokia is still #1, but it's market position is seriously challenged by RIM, Apple and HTC.
- Even Apple is suffering from decreased sales in Q4, but that didn't prevent them from being ranked as the third vendor by sales.
Comments:
- Symbian had lived better days a year ago, but it's still a bit more than 50% of smartphones that runs this operating system.
- RIM and Mac OS X performed exceptionally well even during the tough economical situation.
- Although the share of Windows Mobile shrank a bit, it still maintains its third position. Only blinds can't see that not for long.
Finally, some words on regional sales:
- Dramatic increase (69%) is experienced in sales of smartphone in North-America, which now accounts for 20% of mobile phones in this region. Carriers are agressivelypushing data plans that is beneficial for vendors, too, offering vertical mobile solutions from hardware manufacturing to providing developer SDKs to cloud services.
- While overall device sales dropped, Asia/Pacific recorded a 2.3% growth in smartphone sales.
- EMEA region were up by only 2%, Western-Europe sales increased by 9.6%. Samsung drove sales in 2008 with Omnia as its most successful product.
Tote
Business Opportunities/Services, Mobile OS, iPhone, Windows Mobile, Symbian, Android, Nokia, Security, Market |
Permalink |
Comments (1) |
Trackbacks (0)
Mobile advertising - An experience
tote_b5 | 04 March, 2009 10:51
Background
I decided to give a try to a Reversi-like game found on the Internet just the other day. There was a link to an installation package, which I downloaded and manually installed on my Nokia N95. Even though there was nothing mentioned about that the application is ad-supported, I found the name of the program suspicious since it revealed something about this fact. Never mind, I thought I would still give it a try even though I don't like suprises that come in the form of embedded installation packages (for non-Symbianers: an installation package can contain other 3rd-party software, too, which the main application depends on - these additional programs are referred to as embedded installation packages). Nevertheless, the complementary software has become so intrusive during the installation process and wanted to know such information about me (surprise: it gave me a default birth year, which was exactly the year I was born in - was it an accident or it could find it out somehow?) that I was unwilling to give. Finally I gave up the installation with some bitter taste in my mouth. That was my first experience with Adtronic.
As to mobile advertisement
It's a cliché that there are three-times more mobile devices than desktop computers. If people believe that desktop computers are the homeland of Internet and advertising they will soon have to realize that the transition has already begun from one to the other. Undoubtedly, a device that is always with us is much more compelling platform for advertisers to reach their audience. Their are challenges, though:
- Generally the 'context' is an invaluable piece of information from advertising's point of view:
- What is the user's location so that those ads will be shown first that are more relevant at that place.
- Any kind of information can come in handy regarding the user's social network (gender, age, habits, relation to user, etc.) for better targeted ads.
- What the user really wants to do in the given moment, such as browsing to a car rental web page, calling a carpenter, receiving a status report SMS from the bank, etc.
- Mobile phones has different characteristics as desktop computers: one of the most notable differences is that they have smaller display giving less room for nice ads that can easily capture the user's attention.
Questions to the 'Audience'
There are couple of things that even I, as a advertisement target, have to answer. The root question is the same in all cases: How much am I willing to give up from my freedom when using my beloved gadget?
- How frequently may ads appear without disturbing me?
- How much should I let the ad-provider know about my context?
- What can an ad do without being too intrusive?
- Is it a single application that is 'ad-aware' or I let my entire phone user experience be 'ad-driven'?
Adtronic
Based on what I wrote above you can imagine that I classified Adtronic software as 'suspicious'. But I was surprised to read Forum Nokia Newsletter this morning giving fame to Adtronic. Was it early to judge this software, I asked. A brief summary to those not wanting to visit Forum Nokia:
- Adtronic offers advertising solution for S60 devices.
- Ads are shown upon new/missed calls, SMS, MMS. Ads usually appear above alert dialogs covering the majority of screen real estate.
- How many ads are shown a day can be limited by the user - one must not count on a lot of earned points if it's severely limited, though.
- Earned points can be used in various ways
- For reduction of phone bill (who will take care of this?)
- Points can be used to purchase other applications at a discounted price
- Or can be redeemed for GreenPeace, Unicef (nice feature)
- The whole solution relies on a working network connection resulting in some data traffic (how much?).
Adtronic offers better monetization to developers should they allow their applications to be bundled with this service. May I ask, though: is it really the price users (not the developers!) have to pay to use applications at a low price? Am I wrong with that selling $0.99 programs also works in Apple's App Store and I bet it will soon work on Android Market, too? Do we really need this?
Another question I'd like to be answered, too: where can I use my points to purchase applications? Is it Adtronic's own store? Or an operator store? How does the whole idea fit into the model of unified content store that all device/platform vendors are pushing lately?
I'm sure I've missed a lot of points with regards to the topic. Could you please make the picture clearer? Thanks!
Tote
Business Opportunities/Services, iPhone, Symbian, Android |
Permalink |
Add comment |
Trackbacks (0)
Mobile Monday Budapest - Great success!
tote_b5 | 24 February, 2009 16:35
We held the second Mobile Monday Budapest event yesterday evening. As I already wrote, the topic was mobile software development: Android and Symbian in particular. My colleague gave a great presentation on Android and I talked about Symbian. Unfortunately, the third presenter was not able to come, thus we didn't have a presentation about iPhone development. Nevertheless, we still tried to cover as wide range of platforms during the free Q&A session as possible.
There were something like 50 engineering-minded people (like us:), brave enough to ask smart questions, eager to learn from the others (not only from presenters) and willing to network. The event was sponsored by Forum Nokia (event site is available at bantora.com) and my employer, Agil Eight. Thanks for both!
I'm so happy that this habit slowly becomes a tradition - it's exactly this what we need in our small country. Looking forward to the upcoming MoMo Budapest even in April!
Tote
Symbian, Android, Mobile Monday |
Permalink |
Comments (1) |
Trackbacks (0)
Mobile worm, Yxes.A - an analysis
tote_b5 | 20 February, 2009 11:58
F-Secure and FortiGruard both reported that a new worm,Yxes.A, is spreading on Nokia smartphones based on S60 3rd Edition platform (and probably higher, too). According to FortiGuard:
- "It gathers phone numbers from the infected device's file system, and repeatedly attempts to send SMS messages to those. The messages feature a malicious Web address (URL); upon "clicking" on the address in the received message, the recipients will download a copy of the worm (provided their phones/subscriptions allow for internet browsing)." That is, it's a Trojan.
- Beyond propagating to as many users as possible via the strategy mentioned above, the worm's aim is to gather intelligence on the infected victim (such as serial number of the phone, subscription number) and post it to a remote server likely controlled by cyber criminals.
- It's also noted that worm can mutate easily: "As far as our analysis goes, the worm currently does not take commands from the remote servers it contacts. However, since the copies hosted on the malicious servers are controlled by the cyber criminals, they may update them whenever they want, thereby effectively mutating the worm, adding or removing functionality." It's not that simple, though. It's not like download a new EXE from the Net and it will just work. No new EXE or DLL (a plug-in, for example) can be installed without the assistance of Application Installer, which will eventually require user's attention and approval. Some files that don't have to be installed can be downloaded, though, containing instructions for the worm to execute, however, it's becoming a science fiction if we think that any malware author will put THAT much effort in developing such a system. I'm highly sceptical on that it would be a real threat and refuse to be threatened by that.
- It's also reported that "On launch, the worm executes as the process 'EConServer.exe', which is likely meant to camouflage alongside the existing legitimate system process 'EComServer.exe'". This simply doesn't mean anything: if a process name is only similar to another (system) process name then it doesn't imply anything. And anyway, EComServer.exe is never launched by hand (but by the system upon device start), consequently it's not a valid scenario that the malicious EXE gets launched instead.
- It's a very agressive application, since it "will also automatically run every time the device is rebooted / power cycled. Further, it bears a destructive nature and will kill certain processes such as the application manager (AppMgr)." If that's true then the program must hold very strong capabilities that cannot be granted by a self-signed certificate.
You can see from the list above that the worm can be malicious, indeed. Following from the last point we can conclude even more:
- The program couldn't be self-signed, since the program requires such strong capabilities that the Application Installer will never grant to a self-signed installable.
- It couldn't be signed via Open Signed Offline*, either, since that would limit the spread only to max 1000 devices with given IMEI numbers.
- It couldn't be Certified Signed*, either, since that requires a thorough test done by an official Test House. Even if they hadn't done a thorough test, such a behavior must have turned out very soon.
- All that means that it was Express Signed*. You know, one characteristic of Express Signed is that they do occasional testing, which means that there might be some malicious apps that can go through this filter.
What counter-measures can be taken? First, the certificate of the malware author must be revoked. That means that whenever they will try to publish another application, whatever it will do it will not be allowed to be distributed, but will be filtered out automatically. This doesn't comfort any victims of this virus, though (hmm, are there any?).
Second, it would be just great if OCSP-checking was enabled on every phone by default. OCSP is a protocol that allows the Installer to check it in a database that a certificate is revoked or not. Although it is available on each S60 phones, it is disabled by default. But I go even further: it's not only the Installer that should use it, but other components of the system, too. In fact, the system itself should perform such a cross-check at regular intervals if any of the installed applications have become undesirable for the user (i.e. the certificate used to sign that application has got revoked) in the mean time. I'm unsure as to why this mechanism can be disabled at all, probably because it requires a network connection and data exchange with a remote server. But I think this should be something that operators shouldn't charge for - isn't it in their best interest, too, that the devices using their network wouldn't get infected?
* For more information on various signing schemes, please visit Symbian Signed.
Any thoughts are welcome,
Tote
Symbian, Security |
Permalink |
Comments (2) |
Trackbacks (1)
Mobile Monday Budapest - Mobile Software Development
tote_b5 | 16 February, 2009 22:36
It's time for the 2nd Mobile Monday Budapest event! This time the topic is mobile software development and we selected the three hottest platforms: iPhone, Android and Symbian. I wrote 'we', because I'm among the organizers as well as one of the presenters: my presentation will cover Symbian-based development.
Some information on the event:
Date: Feb 23, 2009
Time: 18:00 - 21:00
For more information, please refer to Nokia's new web service, Bantora, or Mobile Monday Hungary.
Everybody is welcome!
Tote
iPhone, Symbian, Development, Android, Mobile Monday |
Permalink |
Add comment |
Trackbacks (0)
Malware on Android: It has begun
tote_b5 | 27 January, 2009 22:46
No, it's not going to be yet-another I told you so post. Though I did. :) You might have heard of the spreading of MemoryUp virus on Android-powered devices. There are numerous articles mentioning it (like this one ;), let me cite one of them from phoneArena:
"As strange as it may seem, a lot of users have complained of the MemorUp app..."
What is so strange in this? Android's security model is an open invitation to malware authors: anyone can write an application and distribute it freely on Android Market. The secret is that although every application must be signed, it's not mandatory that the certificate used for signing be certified by a Certificate Authority. In other words, you can self-sign your own application.Accountability is lost.
"We’re more worried about the fact that such a harmful application has found its way to Android Market and has stayed unnoticed until now."
"We’re more worried about the fact that such a harmful application has found its way to Android Market and has stayed unnoticed until now."
That's exactly how Android Market works. I'm surprised that you're surprised. Anyone can write and freely distribute their own programs that may even be a malware. Signing ought to prevent from mass virus distribution - as long as signing certificates are certified by CAs (authors can be traced back and prevented from continuing malicious activity). Which is sadly not the case, see above.
"If it has managed to creep inside, wouldn’t there be a chance for others?"
It's not a question, I'm sure there will be more. Even though self-signed applications are limited as to what they're allowed to do, MemoryUp has showed us that this restriction is not enough.
The question is rather what could be done against this phenomenon? One option is that Google leaves it untouched: it will turn out very quickly if a program is malware or not (well, unless if it's a timed bomb). Another alternative is be stricter on what a self-signed app can do and allow only properly (i.e. CA) signed programs to act freely (after user's confirmation, of course). The strictest option would, of course, be if self-signing was not allowed at all. I'm sure you've noticed that the last two options mean that developers would need to pay for (CA) signing. Which is against the principles of Android development.
Looking forward to Google's reaction,
Tote
Android, Security |
Permalink |
Comments (6) |
Trackbacks (0)
MicroWeather for S60 goes Open Source
tote_b5 | 22 January, 2009 10:23
I usually don't write about specific mobile software, but this time it's a bit different. You know, it's one thing that one of my colleagues, Jouni Miettunen, became a Forum Nokia Championlast time thanks to his active participation in Python for S60community. I'm really proud of him, he really deserved the honour.
But it seems that the spirit of open source software has "infected" another colleague of mine. Gabor Fetter, author of MicroPool (a bestseller in its category), MicroPinball and MicroWeather has now decided to make his last piece of software open source. I'm not going into praising MicroWeather, let it be enough that I use it daily. For more information, you can check out the official page at http://sourceforge.net/projects/microweathers60/. But you can do more than being in read-only mode: why not contribute to it? Any ideas, contribution are welcome!
I'm happy to see that we're that agile! ;-)
S60, Development, Palm, Open Source |
Permalink |
Comments (4) |
Trackbacks (0)
What is the world's most recognized song?
tote_b5 | 19 January, 2009 23:10
Nokia |
Permalink |
Comments (1) |
Trackbacks (0)
