30 July 2009 | 21,710 views

Chinese Firm Writes First SMS Worm

Check For Vulnerabilities with Acunetix

Ah another first, and once again China is at the forefront! We recently reported about a Chinese company sharing their huge malware database and now a group of Chinese companies has managed to develop the first SMS worm!

It’s a pretty cool concept, abusing the Symbian Express Signing procedure. It reminds me of the heydays of self-propagating e-mail worms when corporate e-mail servers were getting flooded because everyone in the company was sending the same attachment to everyone else in their address book.

Now with the application integration on mobile phones it’s now possible on mobile phones.

Three Chinese companies — XiaMen Jinlonghuatian Technology, ShenZhen ChenGuangWuXian Technology, and XinZhongLi TianJin — created the ‘Sexy Space’ worms or Yxe Worm (Worm:SymbOS/Yxe.D) and submitted to Symbian OS-based phones through the express signing procedure, said F-Secure Security Labs recently.

“The worm is the first text message worm in history,” said Chia Wing Fei, security response senior manager at F-Secure. “Our labs have received few confirmed reports from China and Middle East at the moment.”

The first stage of Symbian’s signing process is done automatically using an antivirus engine, said Chia, adding that once an application has been submitted and scanned, random samples are then submitted for human audit.

So what next? Anti-virus for your mobile phone? Well that already exists (e.g. Kaspersky Mobile Security).

I’m sure the Symbian developers will tighten up the OS and the signing procedure too. It’s an area that is definitely going to get some attention with people starting to do more on their phones (PayPal just came out with an iPhone app for example) and mobile banking has been gaining popularity.

However, most applications are not inspected by humans through the express signing procedure, he noted.

An attacker can therefore put a web link pointing to the worm’s web site into a text message and invite the user to download the worm by clicking the link, Chia said. Once activated, the worm will install itself on the device, and send a similar text messages to all phonebook contacts listed, he added.

“These messages are sent in your name and from your phone. It means you will pay for each SMS sent by the worm. A typical cost for a single text message might be 5 cents. If you have 500 contacts in your phone, an infection would cost you 500 times 5 cents,” Chia noted.

It could cost you some money getting infected, and definitely cause a headache for you and your friends.

No one likes spam right? Especially when it’s serving up some self-replicating malware.

Source: Network World



Recent in Exploits/Vulnerabilities:
- Microsoft Zero Day OLE Vuln Being Exploited In Powerpoint
- Everything You Need To Know About POODLE SSLv3 Vulnerability
- OpenVPN Vulnerable To Shellshock Exploit

Related Posts:
- France Complaining of China Hacks Too
- Happy Chinese New Year 2011
- Storm Worm Spreading Some Holiday Cheer

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 227,875 views
- AJAX: Is your application secure enough? - 119,152 views
- eEye Launches 0-Day Exploit Tracker - 85,075 views

Low-cost VPS Hosting

3 Responses to “Chinese Firm Writes First SMS Worm”

  1. ruionkoh 30 July 2009 at 11:11 am Permalink

    this is crazy! O.o

  2. d3m4s1@d0v1v0 30 July 2009 at 12:25 pm Permalink

    wow, it seems that the Symbian OS is having several security problems. In the last months I have seen some very risky problems in this OS.
    If cellphone manufacturers don’t start to pay more atention in security, there will be a lot of malware comming.

  3. c 5 August 2009 at 6:04 pm Permalink

    These SMS messages could be easily blocked at the network operator level. For example, the company I work for produces an anti spam solution for SMS, which the network operator can install on their network to remove fraudulent, spam or viral messages from the network. I guess things like this worm increase the demand for such solutions. Interesting how phones are being exploited though.