Infrared Authentication

It is easy for a hacker to use the HotSync operation to steal your data, network
settings, and passwords. It is just as easy (if not easier) to steal information
from your PDA by only having physical access to it for a short time.

The infrared feature of all PDA devices is a convenient method of sharing
contact from one PDA user to another; you simply point and click. In fact, it
is so easy to transfer information that a hacker could use your PDA to
download all your confidential contact information, network settings, and
passwords directly to another device without your knowledge. This information
can then be used to mount an attack against your corporate network.

An even more interesting example of how a hacker could really misuse
your PDA is to download all your information, and then upload a
rogue computer program, called a “Trojan Horse,” into your handheld
device. This could easily erase all your information, corrupt your data,
make your PDA completely unusable, or even infect the corporate network
with a virus as soon as the user reconnects to the wireless network
with his handheld device.
With all these problems apparent from the lack of handheld device
security, the best means of defense is a good offense. Authentication
mechanisms are only now being developed for handheld devices. These
mechanisms allow you to prevent anyone from initiating IR communication
without first authenticating to the device. Unless you know the
proper usernames and password (a password than cannot be entered into static memory), it would not be possible to activate any IR transfer
functionality from the PDA.
The only problem is getting users to understand that this functionality
exists and to use it! Security like this can provide a wonderful means
of protection, but if it is not implemented or deployed, it becomes useless.
Safeguard your mobile device so that your handheld won’t be the
cause of any malicious code getting into your corporate network and
bypassing the firewall—because your PDA is already “inside” the firewall.
Simple measures likes the ones described here are often enough to
protect device and data security. 291