Understanding Windows Mobile Application Security Policies

Execution of programs on Windows Mobile devices depends on the application signatures and their permission levels. Devices can be configured to the following security settings.

• • Security off
• • One-tier prompt
• • Two-tier prompt
• • Mobile2Market locked

Unsigned applications are allowed to run without any prompt and they can access privileged APIs, or protected areas of the registry and file system. The device prompts the user before executing unsigned applications. Once the user allows the execution, application has no restriction on permissions. This is usually safe if you trust the application developer or vendor. The device prompts the user before executing unsigned applications. If the user allows an unsigned application to execute, the application executes with normal permissions but cannot access privileged APIs, or protected areas of the registry and file system. Even the signed applications cannot access the privileged resources unless they are signed with a certificate in the privileged certificate store.