Variants of Cabir cell-phone worm spread
By siliconindia staff writer   |   Thursday, 30 December 2004, 20:30 IST
Printer Print Email Email
BEIJING :F-Secure Corp has warned that enhanced versions of the Cabir cell-phone worm -- the Cabir H and J worm -- have crawled out, though no cell phones have yet been infected. The Cabir H and J worm are actually variants of earlier Cabir A worm. These worms get themselves loaded on mobile phones running on the Symbian Series 60 software and modify it. The worm gets loaded in the phones memory every time you turn on the cell. It disguises itself as a security management feature and displays the word Cabrie on the screen. It then scans for Bluetooth enabled phones in its vicinity and the transfers a copy of the worm to that phone. The worm gets itself transferred to the new phone as a velasco.sis file. Note that you can avoid getting infected by avoiding keeping your phone in “discoverable” mode. Earlier versions of the worm, discovered in June and spread through Bluetooth, were flawed in the way they propagated, which helped to slow the number of infections, says Mikko Hypponen, director of antivirus research for F-Secure Corp. So far, there have been no reports of the new Cabir variants successfully infecting cell phones. Says Hypponen: "The problems with cell-phone viruses are still small, but they're growing." The upshot will be the arrival of a greater number of Cabir variants going forward. To date, some seven distinct sub-species of the worm have been discovered. Most recently, the worm was found within a version of the Skulls Trojan

siliconindia