F-Secure Protects Against First Palm-OS Trojan "Palm_Liberty.A"

"Palm Liberty" not widespread at all

Espoo, Finland - August 30, 2000

Espoo, Finland - August 30, 2000 - F-Secure Corporation (HEX: FSC) announced today the immediate availability of protection against the recently discovered Palm_Liberty.A Trojan which targets the Palm Operating System. The Trojan is generally installed on a PalmOS device from a host computer during a HotSync operation. It can also be beamed from one Palm device to another via infrared. F-Secure Anti-Virus v5.0 detects and disinfects this Trojan during synchronization operations, using the latest update available from http://www.F-Secure.com

"This Trojan represents a relatively low risk to users since it is a 'proof of concept'," comments Mikko Hypponen, Manager of Anti-Virus Research at F-Secure Corporation. "F-Secure has received no reports of damage at this time. Because the Trojan is not a virus, it cannot replicate itself into other files, and does not transfer automatically." Also known as the Palm Virus, PALM/Liberty, Liberty Crack, Warez.prc and Crack 1.1, it could potentially affect devices manufactured by Palm, Handspring, IBM, TRG, and Symbol Technologies.

Symptoms

The Trojan appears in the launcher with the same icon as the "Liberty" application and the name "Crack 1.1". It masquerades as a "crack" for an application called "Liberty" which allows a PalmOS device to run Nintendo GameBoy games. The crack claims to convert the freely available shareware version of "Liberty" into the full registered version. When a user tries to execute the application, the Trojan is activated and attempts to delete all application files on the device and then reboot it.

On a PC, the Trojan will appear as a file named "liberty_1_1_crack.prc" with a size of 2,663 bytes.

Recovery

Users may restore infected Palm OS-based devices using the HotSync manager by setting the System conduit to "Desktop overwrites Handheld".

A technical description of the trojan is available in the F-Secure virus description database at: http://www.F-Secure.com/v-descs/lib_palm.shtml