Click to View

When it comes to handhelds, the Symbian operating system (particularly Series 60 interface phones)—by far the most popular smart mobile device platform—are on the top of every malware developer's list. Today, Anti-virus maker F-Secure warned Symbian phone users about a slippery new trojan disguising itself as an antivirus application.

Although the worm, dubbed Skulls.L, is similar to the Skulls.C trojan, writers have added a new wrinkle that differentiates it from previous variants: It's advertised with a name used for F-Secure's Mobile Anti-Virus installation package.

"The trojan obviously does not contain pirate copied version of anti-virus, it breaks the system applications on the phone, so that none of the smartphone functions of the phone are (sic) as long as the phone is infected," Jarno Niemela, a virus researcher, wrote on the company's weblog.

The Skulls trojan first surfaced in November. The only difference in Skulls.C is the disguise.


Skulls Virus

Once transmitted, Skulls.L can appear in phone dialog boxes with the text "F-Secure Antivirus protects you against the virus. And don.t forget to update this!"

The virus is capable of disabling smartphone features by deactivating messaging, net access and other applications, F-Secure said.

"Once this occurs the application icons on the phone are replaced with pictures of skulls. F-Secure's mobile anti-virus is signed by Symbian - unlike Skulls trojans - and the warning about missing installation package signatures should be a giveaway it is bogus," the company said.

The company recommends against downloading F-Secure anti-virus files from any server other than its own.

"If Skulls.L is installed, only the calling and answering functions of the phone will continue to work. Functions that need some type of system application, such as SMS and MMS messaging, Web browsing and cameras, will not work.

Basic Security
We recommend all handheld users follow some basic guidelines to keep their devices and, perhaps more importantly, the data they hold safe. For instance, in order for Series 60 smartphone users to get infected by a virus/trojan via Bluetooth, he must first answer yes to these two messages:

The worm arrives on the phone as a Bluetooth message which has to be explicitly accepted by the user with the following dialogue.

To receive a worm, a user must then ignore the security warning message and physically click and recognize explicitly that the .SIS has come from an unknown source.

So, as a rule, it is a good idea not to accept Bluetooth messages from unknown users. And as anti-virus company F-Secure's director of anti-virus research Mikko Hypponen recommends, operate your device in hidden Bluetooth mode to avoid being infected.

Mobile Malware History

March 2005
The first virus to spread itself through Multimedia Message Service(MMS) messages is discovered. CommWarrior.a sends itself to any Symbian Series 60 phone world by piggybacking on an MMS message.

January 2005