Subscribe to the::unwired's RSS Feedthe::unwired at Twitterthe::unwired on Facebookthe::unwired on Google Plus
the::unwired Article
VIEW: Caribe virus went wild in Cannes
Posted by Arne Hess - on Saturday, 19.02.05 - 10:09:28 CET under 09 - Thoughts - Viewed 9786x
Not Tagged

Last week in Cannes, during the 3GSM World Congress, many devices were infected by the Caribe virus, as some online magazines confirmed too. The Caribe virus is a worm virus that infects mobiles running on the Symbian OS, including some manufactured by Nokia, Siemens and Sony Ericsson.

Once infected, it begins a continuous search for other Bluetooth devices to send itself to. As a result - if your device is infected - your battery life is significantly reduced, in some cases by up to 50%. The good news is, it's not sending any premium SMS in the background so you are not damaged in terms of financials but anyway - the Caribe is a kind of "proof of concept" for me which clearly shows viruses works on mobile devices and unlike PC viruses, the distribution mechanism is a different since it is using Bluetooth which most modern devices includes.

Later the evening on Wednesday - after a day with many miles and meetings, I met Morten Lund from Bullguard in a pub and he asked me if I have already tested Bullguard Mobile which I hadn't so far because of the lack of time. So I've downloaded it immediately and got my i-mate JAM scanned. You will not believe what Bullguard found on my Windows Mobile Pocket PC Phone Edition too: Caribe! 8O

Since I'm using Bluetooth headsets, the Think Outside Bluetooth keyboard and mouse with my Pocket PCs, Bluetooth is always enabled - for sure and also receiving incoming beams was enabled because I've shared my details with others either by IrDA or by Bluetooth. Therefore it was easy to get my device found but as I said in my previous posting about the Bullguard announcement - I wasn't aware that much about getting a virus by Bluetooth. :roll:

Cheers ~ Arne


 

Related Articles Caribe

Comments
Posted by Helio Diamant on 20.02.05 - 06:24:58

Arne, does the device need to be in discoverable mode to be found by the virus, or is it enough that BT is on? And second, I understand that since your device is a PPC the virus did not work on it after installed, right?

I also see that the anti-virus is identifying the virus in the DestDLL.dll file wich is a file that should be a part of Destinator 3. Does it infect files installed on your system, or is it transmitted as a file for itself?

Posted by Arne Hess on 20.02.05 - 15:46:25

[1] Helio, you are right - it looks it's the Destinator DLL. However, I'm not sure if it is infected or if the DLL appears to BullGuard as an infected file because it has - for any reasons - the same/similar virus signature.
Nevertheless, I will connected BullGuard with Destinator to make sure they sort it out because BullGuard - as I have noticed later - deleted my Destinator installation (something a virus scanner is expected to do).

AFAIK Bluetooth needs to be "discoverable" which I had on my devices for several reasons (e.g beaming/receiving contacts, etc...).

Posted by Helio Diamant on 20.02.05 - 15:49:18

I have just checked about my second question. It turns out that even on a fresh install from the CD the DestDLL.dll file is recognized as Caribe, and the same happens with Skype.

It seems that their program is just not completely reliable yet.

Posted by Arne Hess on 20.02.05 - 16:02:58

[3] What, Skype too!? 8O lol
I will tell Morten since he is one of the investors into Skype - so he should make sure it works, especially now where Skype becomes pre-loaded on i-mate devices!

Thanks for the heads-up!

Posted by RoniXt on 20.02.05 - 20:21:39

This also shouldn't work if you have authorization or encryption enabled for the Bluetooth File Transfer Profile right?
I don't think it should.

Posted by snoopy on 22.02.05 - 15:10:13

[4] It seems to me that they should do a simple QA before launching a new product. This "product" seems to cause more problems than it solves. Especially since Caribe doesn't install under Windows Mobile, only on Symbian/Series60.

Posted by Joseph on 23.04.05 - 08:13:31

Help! I am appealing to anyone who knows how to remove this carbe Virus from my Nokia 6630!

Posted by jomni on 26.04.05 - 04:48:24

Check this site out.

http://www.jamanda.com/

@Arne,

I'm quite surprised how caribe would be installed in your device since it is a .sis file.  Apparently it might be a problem with the Bullguard software as most of the posters are speculating.

Social Sharing
     
This Week's Top Stories
Feeds & More
Awards & More
Recent Discussions
© Copyright 1998 - 2013 by the::unwired® & Arne Hess
All rights reserved!
the::unwired is a registered trademark of Arne Hess.
All trademarks are owned by their respective companies.
All site video, graphic and text content is copyrighted to the respective party and may not be reproduced without express written consent.