First mobile phone worm 'poses no serious threat'

The first computer worm known to affect mobile phones has been confirmed to be the first real virus of its type.

However, experts assure that the Cabir worm, which can infect phones using the Symbian OS used in data-enabled mobile phones, is not a serious threat.

The worm that is packed in a '.sis' installation file tries to spread via Bluetooth and when installed in the phone activates automatically and starts looking for new devices that use Bluetooth. Once Bluetooth enabled phones are located, the worm tries to replicate by sending itself to them. However, the worm only activates if the user of the receiving phone chooses to accept and install a received file named caribe.sis, which contains the worm.

Experts say that the worm found does not cause any immediate threat to phone users, but clearly demonstrates the fact that the technology to write viruses on mobile devices exists and is known to virus writers.

Matias Impivaara, Business Manager, Mobile Security Services, at F-Secure said: “No incidents of Cabir spreading have been reported so far, but this worm is nevertheless perfectly functional and able to spread if released in the wild.

“If a person with an infected phone was walking through a city centre during the busiest afternoon jam, thousands of others could be infected. Even when we tested this worm, we had to do it in the company’s 'bomb shelter' in order to prevent the worm from connecting to other Bluetooth phones and spreading”.

F-Secure warn that the possibility of virus threats on mobile devices is increasing as more advanced handheld devices are introduced to the market.

Protection against harmful content will be required on every terminal using an open operating system.

In the meantime, operators, service providers and mobile device vendors are in the best position to provide appropriate anti-virus services for mobile phone users. Mobile phone users themselves should be cautious about the threat and be careful not to install any unknown applications.

F-Secure's Mobile Anti-Virus detects the Cabir worm and is able to delete the worm components.

The worm's code has been attributed to a virus writing group know as 29a - the group are not know to have written malicious code, but have nonetheless proved that modern mobile phone technology is vulnerable to attack.

(SP)