First Worm For Smartphone

Filed in: Security, Technology — June 16th, 2004

EPOC.Cabir is a proof-of-concept worm that replicates on Nokia Series 60 phones. This worm repeatedly sends itself to the first Bluetooth-enabled device that it can find, regardless of the type of device. For example, even a Bluetooth-enabled printer will be attacked if it is within range.

The worm spreads as a .SIS file, which is automatically installed into the APPS directory when the receiver accepts the transmission.

When EPOC.Cabir is executed, it:

Displays a message (see screenshot), then copies itself to a directory on the phone. (This directory is not visible, by default.)

Runs from this directory when the phone is restarted, so that it continues to work even if the files are deleted from the APPS directory.

Once the worm is running, it will constantly search for Bluetooth-enabled devices, and send itself to the first device that it finds.

There is no payload, apart from the vastly shortened battery life caused by the constant scanning for Bluetooth-enabled devices.

[ via Symantec Security Response ]

Here is removal instructions from the same page:

Install a file manager program on the phone.
Enable the option to view the files in the system directory.
Search the drives, A through Y, for the SYSTEMAPPSCARIBE directory.
Delete the files CARIBE.APP, CARIBE.RSC, and FLO.MDL from the CARIB directory.
Go to the C:SYSTEMSYMBIANSECUREDATACARIBESECURITYMANAGER directory.
Delete the files CARIBE.APP, CARIBE.RSC, and CARIBE.SIS.
Go to the C:SYSTEMRECOGS directory.
Delete the file, FLO.MDL.
Go to the C:SYSTEMINSTALLS directory.
Delete the file, CARIBE.SIS.

Note: this worm only infect EPOC(Symbian) system.

Thought:
Although this is only proof-of-concept worm, but we can expect more security threat in near future for smartphones. Antivirus for smartphone, anyone?