Three New Symbian Virus Variants Cause Concern
F-Secure has found three more variants of the Cabir Virus for Symbian Mobiles. The first found was Cabir.H which was soon followed by Cabir.I and Cabir.J (which are basically just re-compiles of H).
The only good news is that the worm still does very little damage.
These variants have the same basic function as all the Cabir worms and doesn't disable applications like the McDropper and Skulls Trojans do. The
worm uses Bluetooth to look for other phones to
infect and when a suitable phone is found it sends a copy of itself to
the target. In this new strand of variants the worm send a file named velasco.sis instead of the usual cabir.sis so look out for any files with that name. F-Secures Mobile Anti-Virus Software can deal with all of the new variants.
The bad news is that these latest variants have been altered in such a way that they make it easier for the virus to spread from phone to phone.The original Cabir virus was only capable of targeting one new phone for infection per reboot. This meant that after a target phone was out of range, the virus could not spread. This new strand of Cabir , starting with the Cabir.H build, has fixed that problem and the Trojan can now target as many phones as possible per reboot. This makes the virus far easier to spread than its predecessors.
Perhaps more worryingly, these new variants are recompiled versions based on the original source code of the Cabir worm. This mean that the Cabir source code must be freely available somewhere on the web (something I really always suspected) which could mean many more variants of Cabir could be on the way.
UPDATE: F-secure have confirmed that the Source Code for the Cabir Worm is freely available on the net. Read
December 29, 2004 by Tarek Abu-Esber | Permalink