|
|
 Mobile Windows News |  Podcasts |  Videos | Search | Forums | Site News |
|
crossover virus can jump from PC to Windows Mobile (Pocket PC and Smartphone) February 26, 2006 [General] | By Edward J. R. Antivirus researchers are creating virus programs... and by they way they "discovered" or rather "invented" such virus that has special jumping skills... We are not convinced that there is real danger yet, but it is good to know of such possibilities before they will heat... although this "discovering" (or inventing) can actually incite the virus infection (there are rumors that HIV virus also was engineered by virus researchers...). More information from Mobile Antivirus Researchers Association follows. * * * * * MARA research group discovers world’s first PC to handheld crossover malware Advisory: The Mobile Malware Researchers Association (MARA) today announced that it has characterized the first malware to cross-infect a handheld phone or PDA from a binary on the desktop PC. The malware, a Trojan dubbed “crossover”, spreads from a Win32 desktop machine to a Windows Mobile Pocket PC handheld. Detailed analysis and the malware binary are available to antivirus companies and security experts who qualify for MARA membership, which is free. Crossover is the first malware to be able to infect both a Windows desktop computer as well as a PDA running Windows Mobile for Pocket PC. It was sent to MARA anonymously. Included with the malware was the following text file: ______________________________________ virus name: crossover virus - proof of concept virus type: multiplatform Target Platforms: Windows desktop OS's, Windows ce, mobile with .NET CF 1.1 This is a proof of concept virus that shows how a virus can spread from a desktop computer to a pocket pc. With the growing use of handheld devices this type of virus may become very prevalent in the future. For viruses to be more effective they need to spread across a wider range of devices including wireless devices. AVers have to be able to provide adequate protection to deal with these types of viruses. The crossover virus is named so because it crosses over from wired PC's to wireless pocket PC's. It is the first virus of its kind. When executed the virus checks what the current OS is, if it is not windows ce or mobile the virus makes a copy of itself and puts a startup command to the copy in the registry local-machine-current-version-run, the virus then quietly waits for an activesync connection to be detected, it can wait infinitely and everytime the desktop is rebooted the virus recreates itself and again add new copies to the registry, theoretically you can have so many copies running on startup it could degrade or halt the PC's performance. When an active sync connection is detected the virus copies itself to the handheld device and remotely executes the virus to start running on the device. If the current OS is windows ce or mobile the virus erases all files in the \\My Documents directory of the device. Then it copies itself to the \\Windows directory and creates a shortcut to the copy in \\Windows\\startup. When the device is reset the shortcuts execute their target files, here also you can theoretically have multiple copies of the virus running on startup. The crossover virus was written in C# (C Sharp) using Visual Studio .NET 2003, the Communications Library of openNETCF.org was used and a great help. It should run on any handheld device running windows ce/mobile and .NET CF 1.1 This is proof of concept code for educational purposes only. This virus closes the gap between handhelds and desktops, now its one big world open to all. Source: Mobile Antivirus Researchers Association www.mobileav.org Credit: Jonathan Read, CISSP.  Post your comment (free registration is required to post, but if you register you can edit your posts later)
   |
| ||||||
| Mobile Windows News | Podcasts | Videos | Search | Forums | Site News |
