Cingular Wireless has selected McAfee to supply wireless security to subscribers with Windows Mobile and Symbian Series 60 smartphones. The anti-virus vendor's McAfee VirusScan Mobile ($29.99) software will be available for download through the carrier's MediaNet Web portal.

The subscription includes automatic, over-the-air updates against any newly discovered mobile viruses and threats that originate from e-mail, instant messaging, and Internet downloads, and protects multiple entry points including SMS, MMS, Bluetooth and Wi-Fi.

Victor Kounetsov, VP of McAfee Mobile, told PDAStreet the development of McAfee VirusScan Mobile was part of a strategy that the company outlined 2.5 years ago with the creation of the dedicated mobile-device security unit that he now runs. The aim of the division is to attack mobile malware by dealing directly with operators, device manufacturers, enterprises, and - potentially in the future - with consumers.

He emphasized that "operators and manufacturers are the key to the strategies," however.

The partnership with Cingular - the largest carrier in the U.S. - is the security provider's third operator announcement, but the first major one outside of Japan. NTT DoCoMo has McAfee's largest installed base right now—with over 20 million devices—followed by Wilcom.

Kounestsov said to PDAStreet, "They (Cingular) will make our technology available to their subscribers in all different segments: individuals, consumers, businesses, enterprises - on devices where this technology can be installed in an after market fashion."

So, in the current iteration, customers must install and purchase the software themselves, through Cingular's MediaNet Web portal, as mentioned in the opening paragraph. Kounestsov said, "The operator recognizes the importance of this technology, and works with us to provide it. In the details of delivery, we'll make sure there's a seamless experience for the end user."

Cingular and McAfee are working on figuring out how to get this technology pre-installed on the devices, according to Kounestsov. This would likely greatly increase users uptake.

While the first iteration supports Windows Mobile and Symbian devices, the Palm-based Treo 650 is on the roadmap. Kounestsov said, "We'll see the demands on that."

Kounestsov explained to PDAStreet that technology used in this particular implementation was developed over the last four years for the embedded market in Japan. With McAfee VirusScan Mobile, they've taken it to other platforms and shipped it as an aftermarket solution; maintaining the same core technology to provide security functionality to the network operator and the enterprise.

And while you can conceptually compare it to anti-virus or anti-spyware and all sorts of anti-malware for the desktop, the intent is to give operator or enterprise - not necessarily the end user - full control of what's happening on the device. The operator can provide the updates over the air (OTA), for example, with minimal involvement from the subscriber. This is key from a usability standpoint.

"We cannot hold end-users responsible for managing this functionality. It should be delegated either to operators or enterprise IT staff. And the way it is delivered, is a service with minimal users involvement. And we should start doing it now. Way before we get outbreaks like we see on the PC," emphasized Kounestsov

He added, larger enterprises may want full control - true - but smaller and medium-sized companies wouldn't mind having operators managing mobile security for them.

Although there's been very little mobile malware in the wild, McAfee's seen the very same variants of proof-of-concept viruses as everyone else, since the first came on the scene during early summer 2004. As with other vendors' solutions, they've been proactive rather than reactive.

Kounestsov observed, "We've seen quite a few different variants of several concept forms of viruses over the last couple of years. A lot of them very similar to the PC, which is basically trying to propagate from device to device utilizing mobile communication protocols (Bluetooth, messaging). And it's actually starting to happen. People are starting to get infected. And it's not a nuisance anymore. It is more of an issue."

Brief History, Big Problem?
The first proof-of-concept virus for Symbian smarpthones appeared in June 2004, with one for Pocket PC Phones following shortly afterwards. While there's been a lot of activity in the mobile malware world, so far the damage has been minimal (see links below for some more history).

In February, the Mobile Antivirus Researchers Association (MARA) anonymously received the first Trojan - dubbed crossover - to cross-infect a Microsoft-based smartphone or PDA from a binary on a Win32 desktop machine. It uses same executable to infect the Pocket PC and and PC.

MARA's announcement dovetailed with McAfee AVERT (Anti-Virus Emergency Response Team) Labs forecast for this year, released that same month. AVERT Labs predicted a huge increase in mobile threats; up to about 726 from 226 from 2005.

McAfee predicted that the damage caused by new mobile threats is likely to be more extensive than those caused by today's PC threats because of the large volume of smartphones and the small percentage that are protected by mobile security.

For example, in 2004, the 'I Love You' virus penetrated tens of millions of PCs in just a couple of hours despite the fact that half of all PCs had Internet security software installed. By comparison, a mobile threat targeting several operating systems could infect up to 200 million connected smartphones simultaneously because the majority of these devices don't include anti-virus protection.

Since its inception, mobile malware has grown almost ten times faster than PC malware over a comparable period. Yet consumers are also less likely to install mobile security versus PC security because the perceived risk from mobile threats is much less.

Perhaps that's one reason McAfee would like to move to a paradiem where McAfee VirusScan Mobile arrives pre-loaded on a user's device and not as an optional download.