Cabir Virus Affects Symbian OS

Worms in mobile phones

The Russian anti-virus software house, Kaspersky Labs says that it has detected the first ever computer virus that can be distributed via mobile phones. Cabir, the first network worm which propagates via mobile networks infects telephones running Symbian OS. So far, Cabir does not seem to have caused any security incidents.

It seems that the worm was created by a virus writer going under the name of Vallez. This pseudonym is used by 29a, an international group of virus writers. The group specialises in creating proof-of-concept viruses. Among the group's creations are Cap, the first macro virus to cause a global epidemic; Stream, the first virus for additional NTFS streams; Donut, the first virus for .NET and Rugrat, the first Win64 virus.

Preliminary analysis of the malicious code shows that that Cabir is transmitted as an SIS file (a Symbian distribution file), but the file is disguised as Caribe Security Manager utility, part of the telephone security software. If the infected file is launched, the telephone screen will display the inscription "Caribe". The worm penetrates the system and will then be activated each time the phone is started. Cabir scans for all accessible phones using Bluetooth technology, and sends a copy of itself to the first one found.

Analysis of the worm's code has not so far detected any malicious payload.

The worm is coded to run under Symbian OS, used in many Nokia telephones. However, it is possible that Cabir will function on handsets produced by other manufacturers.

 

Thanks ShoresGuy.

Also, I wasn't sure what a "proof-of-concept" virus was, so I looked it up. Here's what I found...

"What is a 'Proof of Concept' virus, and should you be worried about this one?

A 'Proof of Concept' virus is one that is written by a person with advanced programming skills, to demonstrate that something new can be accomplished. Most often, they are sent to an anti-virus vendor, as if to say, "So there!" and no others are created, except by amateur vandals who produce and circulate hacked copies..." more.

I also found more info here and here.

 

Bugwart posted the BBC Link over in the Wireless News Forum... it's the best article I've read about Cabir aka Caribe so far.

 

Mobile viruses, meet the Messaging Anti-Abuse Working Group aka MAAWG...