Friday, January 11, 2008

Malicious programs that may attack your smartphone

Before you can act to protect yourself, you need to know a little about how malicious programs can attack your mobile phone. The following is a list of representative malicious programs on smartphones and the harm they cause:

Force the phone to perform operations that interfere with regular user operations
The original Cabir virus (http://www.sarc.com/avcenter/venc/data/epoc.cabir.html) forces your phone to scan the Bluetooth network all the time, quickly draining the battery.

Disable some device functionality
The Dampig virus (http://www.sarc.com/avcenter/venc/data/symbos.dampig.a.html) replaces some key system libraries and makes many applications, including the Bluetooth user interface (UI), useless on your phone. The Locknut virus (http://www.sarc.com/avcenter/venc/data/symbos.locknut.html) can cripple your phone to the point that you cannot make voice calls. The Fontal.A virus (http://www.sarc.com/avcenter/venc/data/symbos.fontal.a.html) does not cause immediate problems for your phone, but it does secretly replace several key font files, which prevents the phone from booting up once you reboot it. Bluetooth scanners can send malformed Bluetooth messages to your phone and crash its Bluetooth program, forcing you to reboot your phone to recover.

Make phone calls or send Short Message Service (SMS) messages to expensive caller-paid services
The Mosquitos Trojan (http://www.sarc.com/avcenter/venc/data/trojan.mos.html) sends messages to premium SMS service numbers without your knowledge or approval. The message costs are billed directly to your service account. Some Bluetooth-based exploits allow a Bluetooth scanner running on a nearby device to remotely dial your phone or make arbitrary connections using AT commands.

Leak out sensitive personal information
Malicious Bluetooth scanners can allow a cracker to remotely steal the entire memory contents of your phone from another nearby device without your knowledge. In theory, it is also easy to develop a mobile Trojan that gathers information about your contacts, calendar, and media Gallery, and then sends the information to a third-party server on the Internet.


Cabir is the first virus known to target Nokia Series 60 devices. It is largely a proof-of-concept virus. Cabir spreads over Bluetooth and does not contain a payload (the malicious software that does the actual harm). It is benign, except for the fact that it drains your battery with continuous Bluetooth searches. Later variations of the Cabir virus, such as Cabir.b and Lasco, can do real harm to you and your phone.

Based on their attack methods, malicious software on smartphones can be divided into two categories:

Mobile virus or Trojans that are downloaded and installed into your smartphone

Bluetooth scanners that remotely exploit your phone from another nearby device

No comments: