Internet Tech Blog

Bookmark this: del.icio.us | Digg it | Earthlink | Furl | iFeedReaders | ma.gnolia | Maple.nu | Netvouz | Netscape | RawSugar | reddit | Scuttle | Shadows | Simpy | Spurl | StumbleUpon | Wink | Yahoo MyWeb |

Just like computer viruses, cell phone viruses could give dangerous damage for cell phones. What do you think about the viruses that could send your data to another third-person that will use it to get some money from you? Are there any viruses that could send your M-Banking data to another phone? Or a virus that could record the cell phone keypad and runs the money transfer? Let’s see some type of the dangerous cell phone viruses that has been found:

Cabir
Founded: June 2004
Target: Symbian cell phones type 60
Spreading via: Bluetooth
The damage: slowing down the cell phone

Cabir is the first and the most popular Symbian virus today. Cabir is a worm that spread via BlueTooth connection and entering the message inbox with interesting names. If you open those sys file and install it, Cabir will start to search another target cell phone that has open-access Bluetooth connection to spread.

Cabir also known as SymbOS/Cabir.A, EPOC/Cabir.A, Worm.Symbian.Cabir.a, or Caribe virus. The variant spreads with additional characters behind it name, like Cabir.Z, a variant from Cabir B and it spreads using velasco.sis system.

The Cabir will activate the BlueTooth periodically, around 15-20 minutes once, to get another phone targets. No dangerous damage, but if your cell phone infected, the battery will spent faster because it’s used to search another BlueTooth connection.

To prevent it, disable your BlueTooth feature. Activate only if you want to use it. Don’t install Symbian application with name caribe.sis or another strange name.

Skulls
Founded: November 2004
Target: Symbian cell phones
Spreading via: Internet
The damage: the cell phones can’t be used anymore except to calling and receiving calls only.

Another dangerous virus is SymbOS.skulls. Firstly, this Trojan named as Extenhded theme.sis, but today skulls.sis is more famous name used for this virus. This Trojan type damaging the system and causing the menu icons changed become skull icons.

Skull C, H, and S variant will change almost all icons in your cell phones menu. When installed, Skull H opened a notification message: “Install beta_092_free-sms-RM8” and Skull S displaying message “Install BlueNum Stealer”, and some other strange message.

Commonly when the infected application clicked then an error message will displayed. Not only could change the icons, Skull can damage all application that its icon has been changed.

CommWarrior
Founded: January 2005
Target: Symbian Cell phones Version 60
Spreading via: BlueTooth and MMS
The damage: Sending viruses’ replication via MMS to all contacts in phonebook, spending pulse.

Commwarrior included in worm virus family. This worm spreads via BlueTooth, MMS, and memory card exchange with random name xxx.sis.

The attacks type of this virus varies, but the most common is the virus will spread via BlueTooth. Some variant of this virus also will send random MMS to contacts in phonebook.

Commwarrior have many aliases names (you can imagine the wanted criminal have many fake names). F-Secure know it as Commwarrior, McAfee know it as SymbOS/Commwarrior, Trend Micro knows it as SYMBOS_COMWAR.

The last known variant is Commwarrior T. Commwarrior T and Q only infect Symbian ver.8.1 or earlier. This virus will sporadically spreads and sometimes opens an html page in your cell phones with message:

Introduction Surprise! Your phone infected by CommWarrior worm v3.0. Matrix has you, CommWarrior inside. No panic please, it is very interesting to have mobile virus at own phone. This worm does not bring any harm to your phone and your significant data. About CommWarrior worm for Nokia Series60 provides automatic real-time protection against harmful Anti-Virus content. CommWarrior is free software and is distributed in the hope that it will be useful, without any warranty. Thank you for using CommWarrior. CommWarrior © 2005-2006 by e10d0r.

Locknut
Founded: march 2005
Target: Symbian ver.60
Spreading via: Internet download
The possible damage: Crashing cell phone system (ROM), cell phone can’t be functioned, spreading viruses to other cell phones.

Locknut or SymbOS.Locknut is a Trojan virus that using the backdoor in the Symbian S60 system. This virus is dangerous because it can change the binary in cell phone’s ROM system, and causes phone’s operating system stopped and crashing.

Infected Symbian phones have some characteristic that will display messages like this: “App. Closed”, “AppArcServerTh”, “read”, etc. More than that, this virus have ‘additional’ virus like Cabir virus that will installed if the Locknut infects your phones.

Locknut E, one of the variant will damage important files in your Symbian system and caused the infected applications can not be opened. This way effectively will cause your phones totally locked.

Fontal
Founded: April 2005
Target: Symbian phones ver.60
Spreading via: Internet download
The possible damage: Locking the cell phone in the start up module caused the cell phones can’t be used.

Other most dangerous cell phone viruses are:

RommWar
SymbOS/RommWar (name by Symantec antivirus) is a kind of Trojan virus. This virus will put a ‘small application’ in the cell phones. This program will causes vary malfunction, depends on ROM software version of the phones.

The damage caused by this virus varies, like hang, the phones will restart itself, or the power switch will not functioned. This virus is a .sis extension Symbian application, the names could be varies. It can be very unique to make you interesting to install it, for example; theme.sis, xxx.sis, Britney_sis, etc. When installation process runs, the screen will display a message like this: “Install Stoper by WarriorMarrior?”

Today the SymbOS/RommWar has many variant, but 4 most famous are:

• RommWar.A
  RommWar A will use MIME recognizer to give it effects. The infected cell phones will hang and have to be restart, and it will happen over and over even after restarted many times.
• RommWar B
  This second variant will restart the cell phones and prevent you to run the booting.
• RommWar C
  Same as above, this variant will prevent you to turn on your cell phones.
• RommWar D
  This new variant causes vary damages, like cell phones can not turned on, or the power button not functioned. The miracle is, SymbOS RommWar installation sometimes comes from imperfect Kaspersky Anti-Virus Mobile installation.

DoomBoot
The complete name is SymbOS.Doomboot, or SYMBOS_DOOMED. Although the spreads is not as fast as computer viruses, but the effect will causes serious damages.

Doomboot is a Trojan virus type. Many variant have been founded, like Doomboot A, C, L, M, G, and P. Doomboot A makes the files corrupted, and after infecting, it will places another viruses like CommWarrior.B into your cell phones. The corrupted files will prevent you to run rebooting.

SymbOS.Doomboot.A for example, will duplicate the name like installation file for cracked Doom2 game. Commonly the file name is Doom_2_wad_cracked_by_DFT_S60_v.1.0.sis. Doomboot C will infect with another names, like “exoVirusStopv2.13.19”, seems like an antivirus program.

If it is installed, you will see a technically message, but after success installed you won’t see any sign or new icon. Sooner you’ll find that your phone battery will spent faster, because automatically it will runs the BlueTooth connection to infects another cell phones. The same method is used by Cabir virus.

The virus will prevent you to do booting when you have turned the cell phone off. If you have succeeded to reboot, you’ll need to hard-reset your cell phone. Your data, like contact number and photos will be lost.

CardTrap
The first cell phone virus which is built to attacks Windows-based computers. It will put 2 viruses file into the cell phones’ card memory. So many variant has been found, like CardTrap P, Q, R, S until double alphabets like CardTrap AA, AG, AJ, and soon.

Commonly CardTrap duplicating games application name or famous application name like Kingkong, Half Life, Battlefield 2, etc. CardTrap Z, for example, duplicates the name SeleQ 1.7 – Cracked TNT.sis.

Cardtrap damaging the system with turning off some important Symbian built in application. The specialty of this virus, that it could damage some antivirus application. Sooner if there is a chance to connect to computer, CardTrap will plant itself into the Windows-based PC and spreads itself.

Some variant could damage the keypad function and the third-party application, and spreads these corrupted files into the memory card and causing system chaos.

PBStealer
A cell phone virus that some people say comes from Indonesia. PB Stealer has an aliases name, SymbOS/PBstealer, a Trojan that collects contacts number in phonebook and save it in the txt file. It’s not likely danger, but the next method of this virus, it is dangerous.

PBstealer will send the txt file to other cell phones via BlueTooth connection. You can imagine that how important contacts in your phonebook could be exploited and used to criminal purposes. PBStealer D, one of PBStealer variant could compiling and sends the file containing contact numbers, to-do list, database, and notepad at once. To spread itself, PBStealer send 2 sis extension file via BlueTooth connection, ChattingYuk.sis and PBCompressor.sis.

AppDisabler
Like Doombot, AppDisabler places another viruses like Locknut B and Cabir Y to your cell phone. Sometimes it places Skulls J into the system and changing the icons became skulls icon. The most dangerous is, this virus will stop operation system performance and some third-party applications.

Popularity: 59% [?]

Popularity: 59% [?]