|
SymbOS.Cabir mobile phone worm appears in the wild in
the U.S.
21 February, 2005
by Chris Talbot
Symantec announced that there has been a first sighting of
the SymbOS.Cabir worm in the U.S.
The worm, which affects the Nokia Series 60 phones, was found
in the wild in a mobile phone store in Santa Clara, Calif.,
but to quote Douglas Adams: Don't panic. Although the last
year has seen a few small outbreaks of mobile phone-based
attacks, it will still be another two years or more before
such attacks get to be more common, said Vincent Weafer, senior
director of Symantec Security Response.
The SymbOS.Cabir worm first appeared as a proof of concept
in June 2004, and there are currently more than 20 proofs
of concept variations on the SymbOS.Cabir threat. The worm
is able to replicate itself by repeatedly sending itself out
to whatever Bluetooth-enabled devices it can find within close
proximity. It doesn't actually destroy files or cause any
damage to the mobile phone or the data being stored on it.
"What we've seen over the last couple of months is reports
of Cabir in the wild in various parts of Asia, reports in
the past in Canada, and now we have the first report in the
U.S. and some places in Europe," Weafer said. "What's
happening is people are travelling on airplanes, so it's going
from one part of the world to the other. They're actually
carrying the virus with them on their cell phones."
It's probably not going to spread in any big way, though,
Weafer said. There are a few big ifs keeping the worm from
spreading. Because it uses Bluetooth to propagate, the cell
phone the worm is on has to be in close proximity to other
phones. Since it attacks Symbiant-based phones, primarily
in the Nokia Series 60 phone, and not many people have those
types of phones compared to those that have traditional cell
phones, there isn't a lot of opportunity for it to propagate,
he said. Additionally, the Bluetooth on the phone would have
to be enabled and set to accept content to receive the worm.
Obviously those who accept content are at risk, but still,
the risk is small.
"Apart from being affected, the consequence is it can
run out your battery faster than normal," Weafer said.
While cell phones automatically go into standby mode when
they're not being used, the SymbOS.Cabir worm keeps the cell
phone active by continually looking for Bluetooth connections.
For those unfortunate enough to be affected, there are removal
tools available on the Symantec Web site, at www.symantec.com.
|
