The worm, dubbed Cabir, sends itself as a SIS format file named caribe.sis. When launched, the worm seeks out available Bluetooth devices and sends itself to them. The recipient receives a message on their cellphone that reads either just 'Caribe' or 'Caribe - VZ/29a'. If receipt is confirmed, the cellphone owner will then be asked if they wish to 'install Caribe'. Each time an infected cellphone is turned on, it automatically seeks out available Bluetooth users and attempts to infect them.
"No incidents of Cabir spreading have been reported so far, but this worm is nevertheless perfectly functional and able to spread if released in the wild", Matias Impivaara, Business Manager, Mobile Security Services, at F-Secure explains. "If a person with an infected phone was walking through a city centre during the busiest afternoon jam, thousands of others could be infected. Even when we tested this worm, we had to do it in the company's bomb shelter in order to prevent the worm from connecting to other Bluetooth phones and spreading", he continues.
The international virus writing group 29a has claimed authorship of the worm, alleging that their newest member, Vallez, was responsible for its creation. 29a also claimed responsibility for the first Win64 virus, Rugrat, which infects portable executable (PE) files. The group also claims authorship of the 1997 Cap macro virus, the first macro virus to cause global damage.
The discovery of the Cabir worm will undoubtedly give new life to an old cellphone hoax, and likely encourage others to spawn new hoaxes as well. Though Cabir is a worm and can effectively spread using Bluetooth, it has no damaging payload nor does it steal or compromise any contact info on impacted devices.
