ITWeb (Johannesburg)

June 15, 2004
Posted to the web June 15, 2004

Tracy Burrows
Johannesburg

Anti-virus experts have found the first network worm that can spread through mobile phone networks.

Kaspersky Labs reports that it has detected a network worm that infects mobile telephones running Symbian.


Symbian is used in certain Nokia, Siemens, Motorola and Sony Ericsson phones. The worm, named Cabir, may be a 'test virus' and does not appear to have caused any security incidents yet.

Cabir was written under the nickname "Vallez", which is used by an international group of virus writers who specialise in creating proof-of-concept viruses.

Kaspersky says the group's other creations include Cap, the first macro virus to cause a global epidemic; Stream, the first virus for alternate streams in NTFS; Donut, the first virus for .Net; and Rugrat, the first Win64 virus.

Preliminary analysis shows Cabir is transmitted as an SIS file (Symbian distribution file), disguised to be a Caribe Security Manager utility. If the infected file is launched, the telephone screen will display the inscription "Caribe".

The worm penetrates the system and will then be activated each time the phone is started. Cabir scans for all accessible phones using Bluetooth technology, and sends a copy of itself to the first one found.

Anti-virus companies have been warning for some time that mobile networks could be the next targets of virus authors. Mikko Hyppönen, director of anti-virus research at F-Secure, said several months ago that there was a danger of viruses spreading into GPRS networks through USB ports, and that pocket-PC devices would be easy targets for virus coders.

Nokia security experts in Finland say they are analysing the worm, and cannot comment on the matter until the analysis is complete. Nokia says a statement will be issued as soon as possible.

Local anti-virus companies had no information on the worm at the time of publication today.