Slashdot Mirror
Mabir.A Virus Targets Symbian Phones
adennis writes "Exploiting bluetooth and weaknesses in the OS, the Mabir.A virus, like its predecessor, targets the version of the Symbian operating system running on Nokia Series 60 handsets. Since Symbian is the dominant smartphone OS, found on phones made by Motorola, Siemens, Sony Ericsson Panasonic and Nokia, this virus could have great impact. Will mobile OS companies, like desktop OS makers, have to start an automatic update system, or will the OS creators have to start making their software secure?"
Will mobile OS companies, like desktop OS makers, have to start an automatic update system, or will the OS creators have to start making their software secure?
Wouldn't an automatic update system serve to make the software more secure?
Digital Sailor
again?....whats the point of viruses in the first place.. evil teens with no life
There was a time when a virus could install itself just be latching onto a 3.5" disk boot sector and infect tons of machines without anyone having the slightest clue as to its existence.
Nowadays, viruses are so pussified that they need to ask the machine owner to install them. How sad.
I'd say they'll be wanting to make these phones secure, and be sharp about it. Fair enough, these phones with sophisticated OSes are fairly new, and you might expect them to get hit by viruses to start with, but now that the first few viruses have struck the phone companies are going to want to get these phones as secure as possible, so that they can't get attacked so easily in future. Obviously, there's going to be a need to continued updates, as viruses continue to develop and evolve, but more basic levels of protection need to be introduced first.
Santa's suicide mission go!
I wonder if the fact that the recent OS X vulnerability still unpatched after more than 2 months with the symbian component of iSync is related to this? would it be possible for an infected mobile phone to use the exploit in the mrouter code on OS X to infect the OS X machine remotely?
Why shouldnt the creators make the system more secure? Its their responsibility to make it more secure. What if you have to dial 112 (911 for people in other parts of the world) and you cant? Phones have to be secure. I can live with my Windows box isnt but damned if my phone isnt secure.
I will turn off bluetooth or set my phone's visibility to off.
I will turn off bluetooth or set my phone's visibility to off.
There, was that so hard? If for some reason, you refuse to do that, don't accept files from other devices unless you specifically know they're ok. You know, just like you do with your email.
The unsig!
I had to read quite a way down TFA before I actually came to the information detailing what the virus actually does.
"At this point, mobile viruses are more of an irritant than a serious security...the messages that Mabir sends do not contain any text message, only the info.sis file.
So it seems this virus is more of a proof that they can be spread via phones, which we already knew, rather than an attempt to actually damage or corrupt the OS. Hopefully it'lll persuade manufacturers to work more on their phone security, rather than obvious new features for the user.
I'm not stressed. I'm just terribly, terribly alert.
A lot of people already have to update their roaming info. Why cant this stuff be updated at the same time? Current phones wouldnt be able to, but Im sure cellular providers would rather do that than suffer the wireless version of a DOS attack (you know it will happen).
A little dated, but:
What's In a Name?
Digital Sailor
I own a Nokia 60-series phone and much to my surprise I encountered the above mentioned predecessor (Caribe/Cabir) in the wild. (Yep, my bluetooth's always on)
I received over 20 identical messages by Bluetooth messaging, all containing a single application-installation file: caribe.sis I had to approve the reception of the message first before I could view the contents. As I browsed the message contents, a further warning that it contained an application was issued, and I image the standard "not-signed" warning would as well if I'd try to actually install it.
That's 3 warnings I would have to ignore before the virus is installed. Surely in this day and age anyone's brains would have kicked in and wonder whether it would be a wise idea to install an unknown program sent to you by an anonymous stranger? Mobile-phone virii are all still very proof-of-concept in my book...
Will mobile OS companies, like desktop OS makers, have to start an automatic update system, or will the OS creators have to start making their software secure?"
Not having every single Bluetooth service known to man switched on by default when the phone leaves the factory would be a good start. The first thing I did when I got my new PDA phone was to switch everything off except the BT Headset and File Transfer which I set to Maximum possible security since it wasn't set like that by default. Strictly speaking the FT services should only be activated on a need-to-use basis but I don't carry alot of sensitive information on my PDA phone and what there is I have encrypted on an SD card. That would incidentally be another good idea, if manufacturers were to install some sort of file-vault software as standard. I had to install the file-vault software as an optional software package from the companion CD that came with my phone.
Only to idiots, are orders laws.
-- Henning von Tresckow
What a great idea. I'm sure this will work just as effectively as the USA executing alleged murderers - brutal as it sounds, it has at least reduced the murder rate to one of the lowest in the world.
This theme is beat to death. So called "virus" require answer "Yes" three times to be installed. The most vocal reporter of these viruses is F-Secure, manufacturer of anti-virus software for symbian phones. Their CEO speaking on one of the previous virus: "somehow, I'm not sure exactly how this virus get installed on my phone" He did't remember answering "Yes" three times ?
"Please execute this program to destroy your system" is what the approach would have to be and doing a hard reset of all of the memory and hotsyncing it would completely wipe the thing out of the system. This is where volatile memory and a somewhat restrictive setup will benefit the user.
will the OS creators have to start making their software secure?
All commercial operating systems are written to the point where the security is just good enough to sell the product and no further.
When operating systems are tied to the product or the vendor has a monopoly on their market then the point of 'just good enough' is reached long before the end user can regard the product as secure.
I predict: Software security will only become worse as consumor adoption of future devices hostile environments such as the internet increases. Within 10 years, end users will be comfortable with performing routine software maintainence on a myriad of devices they currently consider reliable over the life of the product. This will include: all communications products; vehicles; home automation and security; entertainment systems; electrical white goods and diy tools.
When the dominant multi-purpose operating system can be regarded as usuably secure out of the box for the life time of the product, then I'll reconsider.
"Those who cast the votes decide nothing; those who count the votes decide everything." (attrib. Joseph Stalin)
Why is Slashdot's icon (top right) for the "worms" section a picture of a caterpillar, which is in no way related to a worm?
The evil empire (MS) would have done this ages ago (yes they'd still be bugs that would let things thru, but it'd be better) if it wasn't for programs assuming they can write anywhere etc. MS trapped themselves. With phones being so young, and also being a new product every version (the OS dependencies are small), it'd be hard for them to excuse there being security problems.
But auto update would also be needed, no software is perfect.
Both. Or maybe... isn't it far better for socializing that you're able to talk about how Windows didn't work and you fixed it than to own a machine / gadget / technology that simply works.?
So maybe the answer truly is Neither.
You're assuming they're not the ones who wrote the virus in the first place...
Simple trick, don't buy phones known for crappy security. Symbian phones have been attacked before...
Though I agree this highly bad virus that requires the users permission to install is hardly a "virus" and more of a darwinism.
tom
Someday, I'll have a real sig.
I'm am an experience commercial software developer on the Symbian platform. I have a strong background in many other platforms and i the context of this message, my anonyminity is important since my company can be sued by Symbian just for a biased negative opinion of Symbian made publicly.
Symbian OS is the most expensive platform to develop on. This means more expensive money and time wise. It takes 3 times as many developers to deliver the same product in twice the time as on comparible platforms (brew, iTron, etc...) as for platforms with real development tools such as Windows Mobile, we use ten developers on Symbian to every one on Windows Mobile to produce a lesser product.
Symbian has limited hardware level debugging support (if any at all), they lack so much as a command prompt to log to.
They lack decent compilers and you're stuck with GCC or ARM Realview (neither are that good, satisfactory at best on ARM).
Documentation is aweful at best.
A simple program requires you to just through hoops, more complex sets the hoops on fire.
The emulator environment emulates nothing and simply tries to implement the Symbian UI APIs on Windows and all system level stuff is just layered on Windows. That's fine if you don't need to do anything at the system level.
The development environment is heavily based on CodeWarrior these days. I find this funny since every other company (Nintendo, Sony, Be, Apple, etc..) where Metrowerks had a good footing, the companies found it more profitable to dump CodeWarrior and do it themselves instead. Symbian is the only company stupid enough to choose to rely on Metrowerks, especially with their pathetic resume.
As for security, the fact that anyone could possibly ship a product based on Symbian is a miracle in itself. As for securing it as well, I think you're just asking too much.
Just as the predominant, most accelerated technology growth comes out of human conflict (ie. war), computer security evolves fastest when it is forced to react to real-world situations.
There is no point in asking what their motivation is; heck, I was 16 once too. Plus, nowadays many virus writers are actually commissioned by greater evils, like spam/malware/etc.. comprimised (zombie) machines (of any type) can be misused in a variety of ways..
Am I the only one that misses some of the great cell phones that were actually designed specifically to be the best form of wireless voice communication? I sure wish I could buy a new manufacture Motorola StarTac today!! Black-on-green screen - NO crappy color screens. No stupid ring tones. No photo album. No crappy camera. Two-WEEK standby time!! Just a damn good PHONE...nothing else.
/rant
You blame F-Secure, makers of F-prot distributing FUD?
How old are you? 16?
Read some IT history about F-Prot. You will understand they really don't care about your $something.
I am just afraid of people like you administering Symbian sites, really afraid.
If I ever buy f-prot for my mobile, if there will be a reason ever, it will be people like you.
How many users of you care about exact 3 warnings when they download/purchase any sis from your site?
For people never used Symbian, you must PAY to Symbian/Nokia as a developer (free or not!) to get a "security signature" for your application.
I'd expect something like "This is what Nokia deserved, they tried to rip off developers by Symbian security signature and entire community 'learned' not to care about security alerts"
Not some bs like F-secure cares about your money.
I just wonder how many threats Karpersky labs does found and not announcing because of people like you. Who are them? Oh, just another crooks, going for money!
The symbian community learned to bypass all security alerts saying "yes, yes".
;)
You know the reason? Even the best symbian coders have to instruct users to IGNORE security alerts because they can't afford to buy a Symbian signed license for their application.
Only being a user, I suppose Nokia wants money for it.
About your OT: Got no spam for 3 weeks, looks like even spammers have some kind of brain