Cabir Source Code?

Per their blog, Kaspersky has received a couple of Cabir variants with a threat from the author.
Something about having the source code and releasing more dangerous versions of Cabir.

As 29a has been getting attention from the authorities lately and with rumors about the arrest of some of its members, I doubt Vallez is the one making such a threat.

according to Kaspersky, the new variants have not managed as yet to disable the OS install warning.

I do not currently have samples of these variants.



-----
On a side note, McAfee has added a generic detection for Cabir as of the 22 of December.

Python for Series 60 released

The official Symbian Python distribution for the various Series 60 versions has been released.

I haven't installed the SDK yet, though I notice that there is a Bluetooth example in the package. From the readme it appears that aside from some console display and time issues most scripts should work fine.

Aside from Win32.remabl, I'm not yet aware of any python worms. The cost of entry for Symbian malware authors is now much lower.

Given the size of trojans like Skulls, I would not be surprised if the Python interpreter was installed on a large number of S60 phones by the middle of next year if not sooner. Never underestimate the lure of a free lunch.

More Cabir variants

A spate of minor Cabir variants has arisen in the past few weeks. Looks like it's up to G now.

Not really of much interest except that F-Secure now has a generic detection for Cabir. Considering that most "variants" are simply the Cabir worm with a few internal strings modified it is interesting that it has taken until now.

The size of detection databases has been a point of discussion on the Win32 side for some time. It is even more relevant with regard to the relatively limited resources of smartphones. As mentioned recently, types of detections can sometime be an indication of the limitations of a given scan engine. Six to seven independent detections for highly similar variants is a bit wasteful.

Unlike certain Win32 trojans and worms, the source code for Cabir has not been made available. Lacking source code but having a number of functional descriptions it is of note that no copycat/clones of Cabir have been released. The existing variants are minor "script kiddie" alterations. Essentially, the threat is minimal and could have been handled by a generic detection around the time of the C and D variants.

Trend releasing new mobile AV

Just got the press release yesterday. Trend Micro is announcing Mobile Security.

Some points of note:

• The current download is for Windows Mobile 2003 for Smartphone 2003 only. Other Windows Mobile 2003 editions next month.
  
  Very useful if you have a copy of wince.duts on your phone. Duts.1520 asks permission to infect, so this is not yet that useful.
  
  


• The Symbian version ,also due next month, is written to use the UIQ UI instead of Series 60.
  
  Timely if Cabir should ever be ported to UIQ. Still useful if some new fool decides to pull the Skulls trick with UIQ phones.
  

Seriously a port to Series 60 would not be that difficult. The market for Series 60 AV already has 2-3 players (F-Secure,Symantec,Jamanda), but there is still quite a bit of room for additional offerings. Virus writers tend to target the largest markets, AV should not be avoiding the same.

Skulls stuff

I have received a sample of the skulls trojan.

Except for your rom based applications nothing else on your phone is affected. The funny thing is that unless you already have antivirus software or a file manager installed on your phone there is essentially no way to remove Skulls short of rebooting the phone.

The author has apparently left a note promising more malware in the near future.

Interesting week: Cabir and new Trojan

Per F-Secure, a new sis containing Cabir-b is in the wild. The only significant difference is a new installation directory. No files or filenames have been changed. I believe most, if not all, Cabir fixtools already handle this by scanning the entire drive.

There is also a new "skulls" trojan making the rounds. The file is named "7610.extended.theme.manager.sis". I do not have a sample at the current time.

Cabir, in the wild, in India's largest city?

Techtree is reporting that Cabir is in the wild in Mumbai, India's most populous city.

The article mentions a "Nokia Priority Dealer" offering to clean an infected phone for 850 rupees. The exchange rate is approximately 1 US dollar to 45 Indian rupees. About $18-$19 a phone. Adjusting for cost of living ($ * 5) gives an effective rate of US$90-$95. It's never cheap to live in the big city.

Speaking of viruses written by 29a members , The Register is reporting that Benny of the same group has turned over a new leaf and has joined the ranks of the AV community. An interesting situation.

J2ME, interesting stuff

I've just seen Adam's post on the Full-Disclosure list. Apparently Sun has been informed but no Sun Alert is forthcoming. Considering that unlike the recent JRE XSLT issue the KVM is a harder to update. Most phones would require their ROMs reflashed, meaning a trip to the nearest cell technician or return to factory.

UPDATE: Acoording to a tecchannel interview , licensees(Nokia,Siemens, others) have been provided with a fixed reference implementation. So it is now up to the licensees to update their various products.

The presentation pdf was quite large so I've converted it to .chm format for ease of reading. From 53MB to a bit more than 8. Most of the work was automated with pdf2html and pngcrush and the Html Help compiler.

For those looking for the original pdf, it's currently available through Packetstorm and mirrors.

Adam Gowdiak's Research on J2ME Vulnerabliites

I never really looked at the Hack in the Box conferences;this year it was in Kuala Lumpur. The Register has an article mentioning Adam Gowdiak's presentation at the latest conference.
The PDF of his presentation comes in at about 53 MB(91 pages).

There was a also presentation on .net self compiling viruses .

I haven't gone through the whole thing yet, but here are some interesting quotes from the J2ME presentation:

on future threats -

• The fact that there are more users of mobile devices than
PC’s makes it very attractive target for attackers and worm writers
• It should be expected that remote vulnerabilities for
mobile devices will be published within next 6 months
• Vendors and antivirus industry are not prepared for this kind
of threats (there are no means to protect users of the so called „closed” mobile devices against malicious code)
• Open platforms (PalmOS, Symbian OS, Windows CE)
seem to be easier to protect, but they are also at the most risk.

on the rest of his research -

• Research paper with all the details including some
  additional material that didn’t fit into this 90min talk will be
  published in a couple of months

J2Me might be the "in" malware needed that bluetooth wasn't . I'm not sure how worried I'd be that "closed" mobile devices are at risk, as they usually lack in memory and additional networking capabilities compared to "open" systems. Still, anywhere from 3-6 months to find out. :)

* Hack in the Box is putting out videos of the conference via BitTorrent within the next 4 weeks.

On emulation

I've been looking into fx!32. Due to the nature of the Symbian emulator and the cost of actual hardware, this might be the most feasible/lazy way to analyze most malware. Sort of a phone-bochs. Of course, it's a different story for scanning.

The GBA emu scene is also useful .

F-Secure Releases Cabir Fixtool

F-Secure has finally released a fixtool for Cabir. It weighs in at about 11KB. Kapsersky still wins on size. :) The purpose of Thumb encoding is to reduce size with a tradeoff in speed.

Considering this is a fixtool speed is not that important. The tool does make it clear that it just removes Cabir from your system and it is not a general AV scanner.

Other fixtools are also available, as mentioned previously.

F-Secure's tool is available in two packages, with instructions or separately.
F-Secure blog