Symbian Trojan sends premium SMS

Stephen Withers
Tuesday, 19 June 2007 12:30

Your IT - Mobility

SophosLabs has warned Nokia Series 60 and other Symbian mobile device users of a Trojan that sends an SMS to a premium-rate number every 15 seconds.

Purporting to be any one of several phone utilities, variants of the Viver Trojan have been seen under the names codecs_tool.sis, RulesViwer.sis and NetCompressor.sis.

"The premium rate number used by the Trojan is a short number - expensive things to obtain. However, many content providers obtain batches of short numbers and then sublet them to whoever is willing to pay," observed Anna Szaley of SophosLabs UK. "A keyword or password is assigned by the content-provider in order that a proportion of the revenue generated is paid to the subletter. This model is a perfect fit for hackers, who can essentially rent out the short numbers quite cheaply, and use them for their own financial gain."

Viver was reported last month by Kaspersky and Symantec. According to Kaspersky, the premium rate number associated with Viver attracts a charge of 177 roubles (approx $US7) per message.

"We know that one of the Viver variants was downloaded by around 200 people in less than 24 hours. The Trojan was then deleted by the site adminstration. Simple math tells us that if there are 200 victims, and an SMS costs 177 roubles, then the scammer could have made 14,000 roubles (more than $500) in the space of a single day" commented Kaspersky Lab senior virus analyst Aleks Gostev.

"This month [May] alone we've logged three similar incidents. We can only guess how many more of these Trojans are out there, but one thing is for sure - if there's money to be made, virus writers won't be slow to take up the opportunity," he added.

Despite Viver's potential to run up a large mobile bill, Symantec has assigned it the lowest possible risk rating.