Mikko Hypponen, director of the Finnish security specialists F-Secure, this week discovered a Nokia cell phone in a technology gadgets store in Santa Monica, California, infected with the Cabir mobile phone virus.
Cabir is a Bluetooth-using worm that runs in Symbian mobile phones that support Series 60 platform. It replicates over Bluetooth connections and arrives to the phone’s messaging inbox as caribe.sis file containing the worm. “When user clicks the caribe.sis and chooses to install the Caribe.sis file the worm activates and starts looking for new devices to infect over Bluetooth,” explained Hypponen.
The Cabir virus has twelve variants and was first discovered in the Philippines over eight months ago. Somehow, the virus made it to Santa Monica and into two Bluetooth enabled cell phones that were on display.
It is important to note that the phones at risk have to be in ‘discoverable mode’ for the virus to lock onto the handset and start the transfer of the Cabir worm.
In both virility and contagiousness, the worm does not apprear very ominous. According to F-Secure, infected phones’ batteries lost power quickly, infected other phones, and dialed expensive phone numbers.
The speed of the spread is slow because after a reboot the virus first attempts to contact the phone that initially gave it the virus. If that phone is out of range, a new phone is found and the Caribe.sis file is uploaded. Infection only happens once after each reboot of the phone.
Due to these factors, the worm is not likely to spread quickly in the ‘wild’.
