The present invention relates generally to a security system and method for handheld computers, and more particularly, to a system and method for detecting potentially harmful actions which may be caused by a computer virus and preventing these actions from being performed on a handheld computer.
A huge surge in computer viruses has occurred in the last decade. Computer viruses have gone from an academic curiosity to a persistent, worldwide problem. Today, viruses affect vast numbers of computers in locations throughout the world. A computer virus is generally a manmade destructive computer program or code that is loaded onto a computer system without the knowledge of the user. The computer virus is often a self-replicating program containing code that explicitly copies itself and can infect other programs by modifying them or their environment. Even a simple virus can be dangerous as the virus can quickly use a large portion of the available memory and possibly bring down the computer system.
The term virus generally refers to any destructible or harmful program or code that attempts to hide its possibly malicious function or tries to spread onto as many computers as possible. Viruses can be written for, and spread on, virtually any computing platform. A virus can infect, or become resident in almost any software component, including an application, operating system, system boot code, or device driver. Computer viruses spread by attaching themselves to other programs (e.g., word processing or spreadsheet applications) or to a boot sector of a disk. When an infected file is activated or executed, or when the computer is started from an infected disk, the virus is also executed and attempts to infect other files. Since a virus is software code, it can be transmitted along with any legitimate software that enters the computer environment. Some viruses are capable of transmitting themselves across networks and bypassing security systems. For example, a virus can spread to files on a local area network (LAN) based file server, and from there to other client systems attached to the server. Similarly, systems that run programs from wide area network (WAN) file servers can become infected if the programs on the server are susceptible to infection. In the networked world of the Internet, viruses can rapidly spread.
Many antivirus programs have become commercially available for protection against viruses. There are three main types of antivirus software: activity monitors, scanners, and integrity checkers. Activity monitoring programs attempt to prevent infection before it happens by looking for virus type activity, such as attempts to reformat a disk. Scanners are the most widely used type of antivirus program. Virus scanners generally operate in batch mode, scanning all files on a system, hard disk, or floppy disk, when requested by the user, or at set intervals. They look for known viruses by searching disks and files for scan strings or patterns. A scanner may be designed to examine specified disks or files on demand, or it may be resident, examining each program that is about to be executed. Most scanning programs include an update feature that allows the antivirus program to download profiles of new viruses from the Internet so that the program can check for new viruses soon after they are discovered. Most scanners also include virus removers which are operable to clean infected files. One example of an antivirus scanner is McAfee's VSHIELD.
The third type of antivirus software, integrity checkers, compute a small checksum or hash value for files which are presumably uninfected, and later compare newly calculated values with the original ones to see if the files have been modified. These programs catch unknown viruses as well as known ones. As with scanners, integrity checkers may be called to check entire disks or they may be resident, checking each program that is about to be executed.
Most of the antivirus software available today, such as conventional device resident antivirus scanners, require a large amount of memory. For example, typical scanner software requires approximately 16 MB RAM. While this memory is typically insignificant on personal computers (e.g., desktop or laptop computers) handheld computers often include no more than 2 MB dynamic memory and storage and are not equipped to handle such large memory requirements. Furthermore, handheld computers are generally too slow to provide reasonable virus scanning performance.
Handheld computers include devices such as personal digital assistants (PDAs) and smart phones which are generally small enough to be held in the hand of a user. These devices typically include applications such as an address book, daily organizer, and electronic notepad. Examples of handheld computers include 3Com's PALM PILOT, Handspring's VISOR, Casio's CASSIOPEIA, Compaq's AERO, Hewlett Packard's JORNADA, NEC's MOBILEPRO, Novaltel's CONTACT WIRELESS, Sharp's MODILON, Vadem's CLIO, Apple's NEWTON, Research in Motion's BLACKBERRY, Psion's REVO, NETBOOK, and WORKABOUT, NeoPoint's 1000, and Qualcomm's PDQ. Handheld computers are widely operated in an environment where software and data records are shared between users. For example, software may be transferred between two handheld computers or downloaded from a personal computer system to a handheld computer. Handheld computers may also receive e-mail messages and other data from another handheld computer via an infrared port or from a personal computer through a modem, serial line connection, or network. In this shared environment, computer viruses can spread among handheld computers as rapidly as they do with personal computer systems.
Malicious code that targets handheld computer operating systems such as the Palm OS (Operating System) are beginning to appear. Thus, installing new software, receiving e-mail, or accepting data into a handheld computer through infrared transfer or by syncing with a personal computer can result in a virus attacking the handheld computer. One virus that has recently been identified on handheld computers is called “Phage”. It works by overwriting the beginning of executable files. The host files are destroyed in the process. Once an infected file is transferred to the handheld computer, the virus continues to spread to other programs until they are all infected and destroyed. Phage can spread from one handheld computer to another if infected files are shared via beaming or installed via a docking station.
There is, therefore, a need for a lightweight system and method that identifies potentially harmful code to prevent a virus from destroying data on a handheld computer.