Slashdot Mirror
Worm Developed for Nokia Series-60 Phones
Tuxedo Jack writes "It had to happen. The first worm designed specifically for cellular phones has been developed, and Cabir appears to be a way of effectively killing Nokia Series-60 cellular phones via shortening the battery life due to scanning for nearby Bluetooth devices and propagating itself. This still relies on a user to open it, so hopefully that won't be many, and those that do must use a file manager to find and kill the worm. At least it isn't a dialer!"
After searching Google news and other sources I could not find a similar story anywhere besides this similar story posted on ZDnet Australia. The only problem is that it was dated back 10 February 2004. Not sure if it's the same story... or same worm but worth a read for those that cannot get out to Symantec.
Hmmm.
I'd just like to say that this is why it's still nice to have a phone with relatively limited features - well, that and it's a Motorola (T720). I don't have to worry about the Bluetooth stuff, and I don't even have web access activated on it.
Also, according to the SARC article linked - this worm will attack any bluetooth device that it finds in it's range - not just phones - SARC uses a printer as an example, but what about those nice bluetooth mice/keyboards and PDAs, etc?
They have an image of the phone with the message displayed on it too.
Sure, the difference isn't that big a deal, but to most people, there isn't any real difference between Linux and Unix...
Obliteracy: Words with explosions
Anyone interested in the practice of Toothing ends up leaving their Bluetooth on. For more info on Toothing, see also here (Search for "toothing" in the page that appears - there's even a link to the Toothing forums).
One more reason that cell phone manufacturers need to focus on the big three (battery life, signal strength, ease of use) instead of mindless feature-creep.
As much as I wish that's what they would focus on, they will continue to focus on the holy grail of business: Profit.
I used to sell cell phones, and signal strength didn't sell a single phone for me. As a salesman, I have absolutely no clue what phones recieve better than the others. Sales reps aren't trained on reception, if they are lucky, a customer will let them know which ones they have had success with.
In my experience, the biggest selling factors for phones were a color screen, whether or not it was a flip phone, size, and unique design. When T-Mobile released the phone that swivels around instead of flips down I didn't have a customer walk by without picking it up.
If the customer is uninformed, they will continue to buy phones with buzzwords. Whether or not the sales reps are uninformed, they will continue to sell what makes them the most money. Conviniently enough, they usually know the most about that phone.
Really, this does not prove anything. It doesn't exploit any weakness in the system and very easy to avoid.
I am not sure how many of people who have posted before actually OWN series 60 device, but let me assure you that it's not as simple as accepting somebody's bluetooth transfer.
First of all, you must have bluetooth always on and your device available to all, which is really bad idea considering that it eats your battery much faster. Battery life of the series 60 devices is pretty small as is. Having bluetooth on is sure way to kill it further.
Second, you will have to go through few steps of actually INSTALLING unsigned application. This is VERY intrusive.
Third, this thing does not auto startup. So, when your device is drained off battery, it won't run by itself as far as I can see.
All in all, very poor attempt to create a malware for Series 60. I am sure you can get much higher propagation by installing an autoexec worm inside of S60 warez releases.
Other avenue to look into is malformed MMS message that does buffer overrun and allows to execute arbitrary code. Now this would be a real baddy because you will be infected as soon as you open a message.
Nice try, but no cake.
-- shortcut - the longest distance between two points.
It may be related to this morning's Akamai DNS problems. Many large sites aren't easily accessible at the moment.
Developers: We can use your help.
we think we may have the very first blog worm this past weekend as well. after reports of a potential security exploit in LiveJournal, a small team went to work to create a "proof of concept" self-replicating javascript code designed specifically to post itself in a viewers journal.
More information can be found here
a basic example of self-generating javascript code can be found here
You want a phone just to make calls?
Ok, but why does this mean you don't want bluetooth? Personally I love bluetooth headsets. In case you missed it, Bluetooth was designed with headsets as a priority.
- Bluetooth has a 30 ft range.
- by shorting battery life users will be less likely to carry it to remote systems (a dead phone cannot transmit it).
- Bluetooth connections must be accepted.
- The file also must be accepted.
It is very similar to a virus being spread by email attachments. Most likely the only fix for this would be a stronger warning on the phone when a file is being passed from a Bluetooth connection.The grass is only greener, if you don't take care of your own lawn.
...but also other Symbain OS phones like Sony Ericsson P800/P900 and Motorola a920/a925.