Hold the phone, it's a virus!

David Heath
Wednesday, 10 March 2010 15:26

Business IT - Security

As a mobile phone telco, it's bad enough to supply a phone with malware on the internal storage device.  Doubly so when the recipient works for a major anti-malware vendor.

According to Pedro Bustamante, Senior Research Advisor at Panda Security a fellow employee at the company went out at lunchtime and bought a (seemingly) new HTC Magic smartphone from Vodafone.  Upon returning to the office, they gleefully unboxed it and, in order to manage  connected the phone to their PC.

All the AV alarms went off!

It seems that the memory card in the phone was infected with not one, but three pieces of malware.

The AV software uncovered a variant of the recently shut-down Mariposa botnet (this one being managed by a different bot-herder) which was launched via an autorun.inf file.

Confiker and a password-stealing package were also located on the memory card.

As yet, it has not been determined whether this was a refurbished unit (suggesting a probable one-off incident) or whether there is a batch of these memory cards in circulation.

Either way, it casts Vodafone Europe's quality assurance procedures in a rather poor light.

Around close-of-business time yesterday in Europe yesterday, Panda indicated they planned to obtain a random sample of similar phones to test whether the issue is widespread.

This is not the first time such events have occurred.  ZDNet has compiled and extensive list of such events; including a recent situation where Telstra distributed memory sticks at AusCERT in 2008.