Cingular Cell Phones and Plans

Cell Phone Virus

Date: Apr 13, 2005
Contributor: Noreen Neaves

New cell phone Trojan pretends to be your buddy

Antivirus researchers have uncovered a new Trojan horse aimed at smart phones, making it the second such discovery within a month.

Security firms like U.K.-based F-Secure and Symantec on Monday reported a new malicious program called Mabir.

Like the CommWarrior virus which surfaced last month, the new Trojan is aimed at Series 60 handsets based on the Symbian operating system. In addition, it mimics CommWarrior's propagation tactic by attempting to spread via Bluetooth wireless connections and MMS (Multimedia Message Service), a technology for sending messages with pictures, audio or video over mobile networks.

However, unlike its predecessor which inflicts only Nokia phones, Series 60 handsets from other companies are susceptible to Mabir, Tim Hartman, Symantec Asia-Pacific's senior technical director, told CNETAsia. Siemens and Samsung are among the handset giants that have also licensed the Series 60 platform.

Another difference likes in the way Mabir uses MMS to replicate. CommWarrior sends a copy of itself randomly to contacts saved in an infected phone, guised to look like a legitimate software update from Symbian, or a pornographic MMS message.

In contrast, Mabir will "listen" for incoming MMS and text messages on inflicted phones and replies them with an MMS message containing the program, according to F-Secure. Other than Mabir's installation file, the "MMS messages that Mabir sends do not contain any text message", the company added.

As with previous smart phone viruses like Cabir, users have to agree to go through with the installation program before the Trojan can launch itself. Mabir does no apparent damage to the infected handset beyond trying to spread to other mobile phones.

Hartman said Symantec has rated Mabir as a "low" distribution worm as it is slow to propagate. As a security precaution, he advised users to turn off their phones' Bluetooth function when it is not needed and to set their handsets in hidden Bluetooth mode when using peripherals such as wireless headsets.

While Mabir does not carry a dangerous payload, it is a sure sign that malicious code writers are fine-tuning their malware for mobile devices. After the source code for the first Cabir worm was published on the Web, several variants of program have since emerged.

"It (Mabir) is proof that mobile phone viruses and worms are here to stay," said Hartman, adding that the security measures used on PCs must now be applied to handsets.




For more information relating to "Cell Phone Virus", please visit our Cell Phone Virus page.

The superior wireless special offer
	Cingular digital phone limited time offer
» More wireless network web offers