Virus calling

First mobile phone worm discovered.

The first worm to be capable of spreading via mobile phones has been discovered.

The initial announcement of the proof-of-concept worm was made by

Kaspersky Labs

yesterday (14 June). EPOC/Cabir replicates on the EPOC-based Nokia Series 60 phones, although it is not currently known whether other EPOC-based devices are also affected.

When the file is launched, the telephone screen displays the text ‘Caribe’. The worm will then be activated each time the phone is started. Cabir scans for Bluetooth-enabled devices on the system, and sends a copy of itself to the first one it finds.

The worm is not thought to carry any malicious payload.

It has been speculated that the worm was created by member(s) of the 29a virus-writing group – the same group that is believed to have created W64/Rugrat.3344, the first virus to affect 64-bit Windows systems, and other members of the

W32/Chiton

family, each member of which demonstrates a different “first ever” infection technique.

For detailed analyses of W64/Rugrat and EPOC/Cabir check out the

June and July 2004 issues

of Virus Bulletin.

Posted on 15 June 2004 by

Virus Bulletin