Symbian Worm
Written by ImagesLab.net on Friday, January 25, 2008Got to know about this news in one of the forum I frequently visit. I was shocked when I read this as I'm using a symbian phone. For those who are using Symbian Platform especially S60 2nd Edition phones please take note about this!!!! Phew... luckily mine is the 3rd Edition. I think I'll need to install an antivirus software on my phone soon before anything happens.
FortiGuard Global Security Research Team discovered a new SymbianOS Worm actively spreading on various mobile phone networks. The worm, deemed SymbOS/Beselo.A!worm is able to run on several Symbian S60 2nd Editions devices. These devices include, but may not be limited to, Nokia 6600, 6630, 6680, 7610, N70 and N72 phones.
After an installation phase, the worm engages in a propagation routine: phone numbers located in the contact list of the devices are harvested, and targeted by viral MMS carrying a SIS-packed (Symbian Installation Source) version of the worm. However, the SIS file does not bear a .sis file extension -- rather, it is disguised as a multimedia file with an evocative name: either Beauty.jpg, Sex.mp3 or Love.rm.
Users may know they have been infected if they see unrecognized sent messages in their MMS outboxes. FortiClient Mobile automatically detects and removes the Beselo worm. For users without FortiClient Mobile who believe they may be infected, please contact your mobile carrier or phone manufacturer for technical support in manually removing the virus.
Unlike Microsoft Windows, SymbianOS types files based on their contents and not their extensions, so it is worth noting that recipients of infected MMS would still be presented with an installation dialogue upon "clicking" on the attachment. Therefore, users could easily be deceived by the extension and unknowingly install the malicious piece of software.
In addition to harvesting the numbers stored in the phone address book as mentioned above, the Beselo worm sends itself to generated numbers as well. Interestingly, all those numbers are located in China and belong to the same mobile phone operator. Some of those numbers have been verified to belong to actual customers, rather than being premium service numbers. The whys and hows of such a routine are still under investigation.
Albeit the prevalence of this mobile malware incident is still low, the FortiGuard Global Security Research Team will continue to monitor the situation and update the description with new findings as needed.
FortiGuard Global Security Research Team discovered a new SymbianOS Worm actively spreading on various mobile phone networks. The worm, deemed SymbOS/Beselo.A!worm is able to run on several Symbian S60 2nd Editions devices. These devices include, but may not be limited to, Nokia 6600, 6630, 6680, 7610, N70 and N72 phones.
After an installation phase, the worm engages in a propagation routine: phone numbers located in the contact list of the devices are harvested, and targeted by viral MMS carrying a SIS-packed (Symbian Installation Source) version of the worm. However, the SIS file does not bear a .sis file extension -- rather, it is disguised as a multimedia file with an evocative name: either Beauty.jpg, Sex.mp3 or Love.rm.
Users may know they have been infected if they see unrecognized sent messages in their MMS outboxes. FortiClient Mobile automatically detects and removes the Beselo worm. For users without FortiClient Mobile who believe they may be infected, please contact your mobile carrier or phone manufacturer for technical support in manually removing the virus.
Unlike Microsoft Windows, SymbianOS types files based on their contents and not their extensions, so it is worth noting that recipients of infected MMS would still be presented with an installation dialogue upon "clicking" on the attachment. Therefore, users could easily be deceived by the extension and unknowingly install the malicious piece of software.
In addition to harvesting the numbers stored in the phone address book as mentioned above, the Beselo worm sends itself to generated numbers as well. Interestingly, all those numbers are located in China and belong to the same mobile phone operator. Some of those numbers have been verified to belong to actual customers, rather than being premium service numbers. The whys and hows of such a routine are still under investigation.
Albeit the prevalence of this mobile malware incident is still low, the FortiGuard Global Security Research Team will continue to monitor the situation and update the description with new findings as needed.
Source: LowYat.Net
2 comments: Responses to “ Symbian Worm ”
By Dumpling on January 25, 2008 at 10:29 AM
Hey, I just got myself a Motorola Motokrzr K3. Want to know if you can do comparison of this phone vs my old phone Sony Ericsson W880I.
By Anonymous on January 25, 2008 at 12:30 PM
sure i can, let me explore these 2 phone and wait for my next post :)