Windows Mobile 6.5 Application Revocation

This article provides an overview of the remote software removal and application revocation mechanisms integrated into Windows Mobile 6.5. Released in late 2009, the operating system introduced centralized application distribution through the Windows Marketplace for Mobile, introducing administrative controls and remote "kill switch" capabilities designed to neutralize rogue, insecure, or malicious applications.

Windows Marketplace for Mobile Application Revocation Service

The primary consumer-facing mechanism for remotely removing malicious software in Windows Mobile 6.5 was the Windows Marketplace for Mobile client's built-in application revocation system, commonly referred to as a remote "kill switch."

When an application distributed via the Marketplace was discovered to contain critical vulnerabilities, malware, or policy violations, Microsoft could revoke it globally from the backend servers. The on-device Marketplace client periodically communicated with the catalog servers to check the validity of installed items. If an application ID appeared on the revocation list, the client automatically initiated an uninstallation sequence or disabled execution permissions for that binary, preventing it from running on the user's handset without requiring manual user intervention.

Authenticode and Certificate Revocation

Windows Mobile 6.5 relied heavily on Authenticode code signing to enforce its security architecture, separating applications into privileged and unprivileged execution tiers.

  • Certificate Revocation Lists (CRLs): Applications installed outside the Marketplace were signed by commercial Certificate Authorities (CAs) embedded in the device's trusted root store. If a developer's signing key was compromised, the issuing authority published a CRL update.
  • Hash and Signature Invalidation: During system updates or synchronized security policy updates, invalid or compromised certificates were blacklisted in the local certificate store. Once the signing certificate was invalidated, the Windows Mobile operating system's security manager refused to launch the associated binaries, rendering the software inoperable.

Enterprise Device Management (OMA DM and SCMDM)

For corporate deployments, Windows Mobile 6.5 supported enterprise-grade remote removal tools operating independently of the consumer Marketplace:

  • System Center Mobile Device Manager (SCMDM): Administrators used SCMDM to deploy and manage software packages over-the-air. If an application needed to be removed, administrators could issue an uninstallation directive via the Open Mobile Alliance Device Management (OMA DM) protocol. The target device received the instruction over the cellular network or Wi-Fi and silently uninstalled the specific .cab or .msi package.
  • Software Restriction Policies: Administrators pushed registry policies that blacklisted specific application paths, filenames, or cryptographic file hashes, preventing execution even if the files remained on the file system.
  • Exchange ActiveSync (EAS) Remote Wipe: While not an application-specific uninstaller, EAS served as a final revocation safeguard. If a device was severely compromised by malicious software, an Exchange administrator could issue a remote wipe command to reset the handset to factory defaults.