Cell phone viruses, largely considered a paper tiger in the digital security world, became a bit more dangerous this week with the release of a two-pronged program.

Writers have released a virus, known as Lasco.A, that spreads both through wireless connections and by attaching itself to files, antivirus company F-Secure said Monday. Until now, malicious cell phone programs have spread using one mechanism or the other.

"We have received a new Symbian malware that combines two spreading tactics, which is common in PC malware but previously unheard of in mobile systems," F-Secure said in a posting on its Web site.

The Lasco.A virus will attach itself to any application file on a phone that uses the Symbian operating system, F-Secure said. It is activated when cell phone owners click on the file and install it on their handsets.

"Thus any (application) file in the device that gets copied to another phone, as frequently happens as people swap software, will also contain a copy of Lasco.A," F-Secure said.

The program also acts like a computer worm, attempting to copy itself directly to any phone within range using Bluetooth wireless technology, F-Secure said. That capability is similar to several recent worms--variants of the Cabir worm--that have managed to spread to a limited amount of phones in the wild.

Such programs have not been very successful, however. Only recent cell phone operating systems are programmable to the extent that viruses can effectively spread. Moreover, the large number of proprietary operating systems used in cell phones make the development of broad threats much more difficult.

As the new virus can only spread on cell phones that have Bluetooth in discoverable mode, the best way to protect handset systems is to set it to hidden Bluetooth mode, F-Secure has advised.

SymbOS.Cabir is a proof-of-concept worm that replicates on Series 60 phones.

This worm repeatedly sends itself to the first Bluetooth-enabled device that it can find, regardless of the type of device. For example, even a Bluetooth-enabled printer will be attacked if it is within range.

The worm spreads as a .SIS file, which is installed into the APPS directory. There is no payload, apart from the vastly shortened battery life caused by the constant scanning for Bluetooth-enabled devices.

Also Known As:  EPOC.Cabir, Worm.Symbian.Cabir.a [Kaspersky], Cabir [F-Secure], EPOC/Cabir.A [Computer Associates], Symb/Cabir-A [Sophos], EPOC_CABIR.A [Trend], Symbian/Cabir [McAfee]

Type:  Worm
Infection Length:  15104 (caribe.sis), 11944 (caribe.app), 11498 (flo.mdl), 44 (caribe.rsc)



Systems Affected:  EPOC
Systems Not Affected:  DOS, Linux, Macintosh, Novell Netware, OS/2, UNIX, Windows 2000, Windows 3.x, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

(12)+vallez, the new 29A member, coded the very first virus infector for mobiles!