New Symbian cellphone Virus

[Fire14]

By Robert Lemos
URL: http://news.zdnet.com/2100-1009_22-5500229.html


MetalGear.A isn't the type of surprise gift cell phone users are looking for this holiday season.
The Trojan horse combines several malicious mobile phone programs that work to spread over Symbian-based phones, antivirus-software maker SimWorks said in a release published Tuesday. The program, camouflaged as a version of the game "Metal Gear Solid," will disable antivirus programs, including SimWorks, as well as other programs, the company said. The attack also installs a version of the Cabir virus, which spreads through the Bluetooth short-range wireless protocol, the firm said.



Photo: SimWorks
Disguised as a video game,
the MetalGear program disables
antivirus software on mobile
phones and attempts to replicate.If the user opens the fake MetalGear program, Cabir will run and try to use Bluetooth to reach other phones through another file, SEXXXY.sis, SimWorks stated.

To date, Trojan horses and proto-viruses aimed at smart phones have mostly failed to spread. In a few cases, Cabir.a has managed to jump from phone to phone using Bluetooth. However, Cabir's spread--and the spread of all phone viruses--is severely curtailed by the need for users to accept and install the programs.

One program, Skulls, would change all the icons on a phone to skulls, but also corrupt the phone's programs. In August, the Mosquito program drew little blood.

[Fire14]

Here is another one that just came out.

By Ingrid Marson
URL: http://news.zdnet.com/2100-1009_22-5515686.html

A new variant of the Skulls Trojan horse that affects Symbian-based cell phones has been discovered.
F-Secure has reported that Skulls.D kills off all system applications, as did previous variants. But rather than turning individual application icons into skulls, as the first version of the malicious software did, Skulls.D tells people their cell phones have been infected by displaying a full-screen flashing skull, the security software maker said on Monday.


The first Skulls variant was discovered at the end of November. A later version was packaged with the cell phone virus Cabir.

The new Skulls variant pretends to be Macromedia Flash player and affects Symbian Series 60 devices. People whose handsets have been infected cannot run programs, take pictures or send text messages, although they can still make phone calls, F-Secure said.

The Trojan horse also prevents people from installing new applications, so the majority of people with infected handsets will need to reset their phone. This will leave the phone in its default factory condition and delete data such as address books.

F-Secure said it has only had reports of Skulls.D from two people, whose phones were infected after they downloaded an application from a Web forum. Phone owners can reduce the risk of infection by exercising caution, said Mikko Hypponen, the director of antivirus research at F-Secure, which has posted an advisory.

"Be careful about what you download and where you download it from," Hypponen said. "You are most at risk if you are downloading illegal copies of applications, especially from peer-to-peer networks."

Hypponen warned there are likely to be more Skulls in the future. "We are waiting for the next variant," he said.

[Fire14]

Worm Turns on Symbian Cell Phones


January 18, 2005

The Lasco mobile-phone worm, based on the same code as the first mobile phone virus called Cabir, is the first to target Symbian Installation System files. While it infects SIS file systems, a separate Windows application hunts and infects SIS archives.

Infected phones spread the worm via Bluetooth and will transmit the code to the first device available in its broadcast radius. The inclusion of code targeting Windows indicates that virus writers are responding to the increasing integration of Bluetooth in laptops and PCs.

"Last year saw the start of threats aimed at mobile devices. This new threat picks up where they left off," said David Emm, senior technology consultant at Kaspersky Labs in a prepared statement.

Preliminary analysis shows no harmful payload as of yet. But, battery life can be drained from the worm’s continuous search for other Bluetooth devices.

Future problems could be substantial, say analysts. Meanwhile, Microsoft officials are constantly working to solve coding vulnerabilities.

“Many of the current problems with Windows and Internet Explorer based viruses and worms result from poor coding practices. Has Microsoft really mended their coding ways? Only time will tell," says Christian Byrnes, Senior VP, Technology Research Services at MetaGroup.