Text me and I'll reply with a virus

More mobile malware madness

By John Leyden • Get more from this author

Posted in Software & Security, 4th April 2005 16:24 GMT

Free whitepaper – Essential archive requirements for eDiscovery

Virus writers have created a third mobile phone virus capable of replicating via MMS messages. The Mabir worm, which targets Symbian Series 60 phones, is not spreading, but its ability to propagate via Multimedia Messaging Service messages (MMS) gives cause for concern.

Mabir is essentially a variant of the Cabir worm, which spreads only over Bluetooth, with added MMS functionality. An analysis of the worm by anti-virus firm F-Secure suggests that Mabir-A is based on the same source code as Cabir and is likely the product of the same coder.

Mabir-A spreads using Bluetooth using the same routine as early variants of Cabir. When Mabir-A activates it will search for the first Bluetooth phone it finds, and start sending copies of itself to that phone.

The MMS spreading function of Mabir-A uses a new social engineering technique. Instead of just reading all phone numbers from the local address book (as with an earlier mobile virus called A virus called Commwarrior-A), Mabir-A replies an infected MMS message in reply to any SMS or MMS messages sent to an infected phone.

MMS messages are text messages that include an image, audio or video. They are sent from one phone to another or via email. ®