Aggressive mobile worm uses alarming new tricks
By: Jeremy Kirk
IDG News Service (London Bureau) (08 Aug 2006)
Mobile phone malware writers are up to no good again. A security vendor has detected a new variant of an aggressive Russian mobile worm that uses some alarming new tricks.
Like its earlier relatives, Commwarrior.Q will jump onto another phone using a short-range Bluetooth wireless connection, said F-Secure Corp., an antivirus company based in Helsinki. It also spreads via MMS (multimedia messaging service) or by an infected memory card inserted into a device.
Commwarrior.Q is not spreading widely. But the worm has new traits that make it particularly aggressive and it appears to be one of the most complex pieces of mobile malware created to date, said Antti Vihavainen, vice president of mobile security for F-Secure.
Commwarrior.Q will continuously send MMS messages from midnight to 7 a.m. to people in an infected phone's address book. It cleverly assembles a text message from the phone's "sent" file, making it appear legitimate, Vihavainen said.
After 7 a.m., however, Commwarrior.Q stops that action, as it would be noticeable to the user. It then starts scanning other phones to infect via Bluetooth.
Commwarrior.Q will infect any Symbian OS application installation files, called SIS files. Unlike its predecessors, the SIS files that Commwarrior.Q infects take on random names, making them harder to identify. Previous versions of Commwarrior used the same file name, F-Secure said.
The SIS files also range in size from 32,100 to 32,200 bytes, making them hard to distinguish from MMS messages if mobile operators wanted to filter them out of their networks, Vihavainen said.
Commwarrior.Q can't automatically infect a phone, however, Vihavainen said. A user will be prompted if they receive an infected SIS file, and they have to accept the file. Users also get another security prompt. After that, however, Commwarrior.Q will start running.
F-Secure has notified mobile operators of the worm, Vihavainen said. Operators could potentially filter out all transfers of SIS files between phones, but that would reduce functionality, he said.
Commwarrior.Q affects Symbian Series 60 phones that use Symbian OS version 8.1 or older, F-Secure said.
Users may eventually know if they are infected, as Commwarrior.Q intermittently displays an HTML (Hypertext Markup Language) page with text that says, in part, "No panic please, is it very interesting to have mobile virus at own phone."
Commwarrior was first seen in 2005, and several variants have been detected. One version, Commwarrior.B, send continuous MMSes, draining the phone battery unbeknownst to users. When charged, the phone won't reboot.
Commwarrior.Q does not damage data on a phone, Vihavainen said. But a user could incur high phone charges caused by the worm sending messages during the night, he said.