Monday, January 10, 2005

First File Infector for Symbian Based Mobile Phones

A new Symbian OS virus has been released that unlike previous Symbian OS malware that has been released recently is a file infector, in that it can infect Symbian OS executable SIS files.
The worm which is currently known as Lasco.A uses bluetooth as a means to infect other mobile phones that use the Symbian Series 60 platform.It seems that Lasco.A is based on the same source as the Cabir.H worm and is in part very similar to Cabir.H. However unlike Cabir.H, Lasco.A is able to infect Symbian executable SIS files.The worm replicates over bluetooth connections and arrives on the phone as the file velasco.sis. When user executes the velasco.sis and chooses to install the file the worm activates and starts looking for new devices to infect over bluetooth. As long as the target is discoverable and within range the infected SIS file is sent to the remote device.Like the Cabir worm before it, Lasco.A can only infect Symbian Series 60 based phones that have Bluetooth turned on and are set to discoverable.