New Cellphone Worm: CommWarrior

A new worm has emerged which demonstrates the power of using a technology like MMS to send and receive malicious traffic. Formerly, the only cellphone worms that we had seen were like Cabir, which uses Bluetooth to spread, but it requires that the user accept the file transfer. A new worm, Commwarrior, appears to be a step forward for mobile phone malware. Details from today's F-Secure antivirus weblog:

We're currently analysing CommWarrior, which runs on Symbian Series 60 platform. It attempts to spread over both MMS and Bluetooth. The virus seems to be from Russian, as it contains text that says "OTMOP03KAM HET!". Which roughly translates to "No to braindeads".

More information on CommWarrior is available from F-Secure's CommWarrior page. No other vendor has posted any information as of yet on this worm. Note that F-Secure sells an AV product for mobile phones.

The MMS protocol is very similar to normal Internet mail traffic, and includes MIME attachments and auto-open and execution, just like problem email clients. This then allows for all sorts of nastiness to ensue with your infected phone and malicious attachments. Due to the workload in the file transfers, an infected phone is likely to be sluggish or even stall, upsetting infected users. This helps minimize the likelihood that someone would be spewing mobile phone malware without knowing it. [Thanks, Arrigo.] Also note that the phone network is a centralized and managed network, and unlike the Internet message routers exist. This allows for a filter to be placed in the network and effectively stave off any worm infections, and even block access to the infected phone.

Regular readers might be asking why wormblog doesn't post more stories on new worms more frequently. Let's face it, new mass mailer worms appear at least daily, and they're usually variants on a theme. Most of the new network based worms at this point are variants of existing worms (ie the Rbot family). And most other worms are relatively low impact or not displaying any new techniques (aside from repackaging). Hence, keeping up with this would be a time consuming and a relatively low value activity. For new worm announcements on such a regular basis I suggest you read the F-Secure Weblog, for example, and use an RSS reader to keep up with some of the latest virus and worm alerts from Virus and hoax information RSS feeds from the Sophos site or the eAlladin Virus feed. Wormblog will continue to bring you information about new major threats, new developments and trends, and (of course) lots of research information.

One trend that has been visible to me and others is an uptick in IM worms. Note that we're not covering them substantially here because they're derivative works, have so far not been a world-wide epidemic, and don't yet demonstrate anything significant. However, this increased interest in them is a worthwhile trend to note, and we'll keep our eyes on it.