First PC/phone crossover virus found

Experts warn of new breed of converged viruses

Iain Thomson, vnunet.com 22 Sep 2005

The first mobile phone virus capable of infecting a PC has been found, signalling the beginning of a new breed of converged viruses.

Experts at Trend Micro have detected the Cardtrp worm that affects handsets running the Symbian 60 operating system. A list of the vulnerable hansdets can be seen here.

Cardtrp spreads via Bluetooth and MMS, but if the phone has a memory card it sends a copy of a Windows virus known as Wukill onto the card.

When the card is inserted into a PC the malware masquerades as a legitimate file icon to encourage users to open it. Once opened the code installs a backdoor on the PC and begins to harvest passwords before forwarding them on.

"This attack is really a proof-of-concept and may be an indication of a new type of blended threat to come," warned Raimund Genes, president of Trend Micro's European operation.

"As mobile threats continue to evolve, it is likely that we will see further attacks similar to this but utilising more robust propagation techniques and therefore carrying a higher potential for infection."

Genes urged users to be vigilant to the new threat, but said that Trend Micro is not expecting a mass outbreak any time soon.

In the meantime mobile phone users should only download applications from trusted sites and never accept an unsolicited application from an unknown third party.

Mikko Hyppönen, chief research officer at F-Secure, said: "The goal of this backdoor Trojan is most likely to cause the user to infect his PC when he is trying to disinfect his phone.

"A typical reaction of the more advanced user encountering a Trojan like Cardtrp would be to insert the phone's memory card into a PC to copy a file manager or disinfection tool to the card. But a careless user might allow his PC to become infected in the process."

See also: