|
|
|  |
|
|
|
|
F-Secure Malware Information Pages: Cabir
|
|
|
| Radar |
 |
|
|
|
Summary
|
Cabir is a Bluetooth-worm that runs on Symbian mobile phones that support the Series 60 platform.
The details below describe the Cabir.A variant. |
|
|
|
Disinfection
|
Disinfection
F-Secure Anti-Virus for Symbian Series 60
http://f-secure.mobi
F-Secure Anti-Virus for Symbian Series 60 will detect Cabir and will delete the worm components. After deleting the worm's files you can delete this directory:
- c:\system\symbiansecuredata\caribesecuritymanager\
Or you can use our free disinfection tool, available from here as a Symbian SIS installation file which you can download directly to the
phone:
- Open web browser on the phone
- Go to http://mobile.f-secure.com/disinfection/index.html
- Select link "F-Cabir"
- Download the file and select open after download
- Install the F-Cabir tool
- Go to applications menu and start F-Cabir
- Select scan and answer yes when tool asks do you want to disinfect
Or you can download the file from our web site
Or here as a Zipped file:
Alternatively, you can disinfect the system manually by installing a file manager application and manually deleting these files:
- c:\system\apps\caribe\caribe.app
- c:\system\apps\caribe\caribe.rsc
- c:\system\apps\caribe\flo.mdl
- c:\system\recogs\flo.mdl
- c:\system\symbiansecuredata\caribesecuritymanager\caribe.app
- c:\system\symbiansecuredata\caribesecuritymanager\caribe.rsc
|
|
|
|
Detailed Description
|
Cabir is a Bluetooth-worm that runs in Symbian mobile phones that support the Series 60 platform.
Cabir replicates over Bluetooth connections. It arrives to the phone's messaging Inbox as a file named caribe.sis containing the worm. When the user clicks caribe.sis and chooses to install the caribe.sis file, the worm activates and starts looking for new devices to infect via Bluetooth.
When the Cabir worm finds another Bluetooth device it will start sending infected SIS files to it, and lock to that phone so that it won't look for other phones even when the target moves out of range.
Please note that the Cabir worm can only reach mobile phones that support Bluetooth, and are in discoverable mode.
Setting you phone into non-discoverable (hidden) Bluetooth mode will protect your phone from the Cabir worm.
But once the phone is infected it will try to infect other systems even as user tries to disable Bluetooth from system settings.
When the user clicks on the caribe.sis file in phone's messaging Inbox the phone will display a warning dialog:
If the user selects "Yes" the phone will ask the normal installation question:
If the user selects "Yes" the Cabir worm will activate and show a dialog that contains the name that malware author wants to give to the worm and the author's initials and the group initial of 29A. Although it seems that in some phone models, for example Nokia 6600, this dialog is not shown.
Replication
Cabir replicates over Bluetooth with a file named caribe.sis that contains the worm's main executable caribe.app, system recognizer flo.mdl and resource file caribe.rsc. The SIS file contains autostart settings that will automatically execute caribe.app after the SIS file is installed.
The caribe.sis file will not arrive automatically to the target device, so the user needs to answer yes to the transfer question while the infected device is still in range. The question will be repeated to the user if they select no.
When the Cabir worm is activated it will start looking for other Bluetooth devices, and starts sending infected caribe.sis files to the first device it finds. The replication routine in Cabir contains a bug that causes it to lock onto the first device it finds and it won't look for other devices.
This means that Cabir is capable of sending infected files to only one other device per activation. So Cabir will try to infect one other device when it is activated the first time, and then one more each time when the phone is rebooted.
In our tests we also found that the newly infected phone will first look for the phone that sent the infected file. So Cabir is capable of spreading widely
only in cases where the phone that sent the infected file is out of range before user activates Cabir on the new phone.
Which means, that while Cabir is capable of spreading in the wild, it would spread quite slowly and would not cause large epidemic.
One curious fact is that in Series 60 phones the bluetooth functionality is independent from the GSM side, and if the phone is rebooted Cabir will try to spread even if the user doesn't enter his PIN code.
Infection
When the caribe.sis file is installed the installer will copy the worm executables into following locations:
- c:\system\apps\caribe\caribe.app
- c:\system\apps\caribe\caribe.rsc
- c:\system\apps\caribe\flo.mdl
When the caribe.app is executed it copies the following files:
- caribe.app to c:\system\symbiansecuredata\caribesecuritymanager\
- caribe.rsc to c:\system\symbiansecuredata\caribesecuritymanager\
- flo.mdl to c:\system\recogs
This is most likely done in case the user installs the application to the memory card.
Then the worm will recreate the caribe.sis file from worm component files and data blocks that are in caribe.app.
After recreating the caribe.sis file, the worm starts to look for all visible Bluetooth devices and send the SIS file to them. |
|
|
|
F-Secure Corporation |
|
|
|
|
|
Last Modified: January 01, 2006
|
|
|
|
|
