Brador Trojan infects Pocket PC

Antivirus vendor Kaspersky is warning of a new Trojan impacting Pocket PCs running Windows CE and and newer versions of Windows Mobile. The Trojan, dubbed Backdoor.WinCE.Brador.a, or simply Brador, creates a file named svchost.exe in the Windows Startup folder on the Pocket PC, allowing it to gain control whenever the device is started. According to Kaspersky Labs, Brador sends the IP address of the infected Pocket PC to the virus writer, alerting him/her to the fact that the backdoor on the infected device is active. The Brador backdoor then listens on port 2989 for commands from the Trojan author, which could allow the author to upload and run further malicious code.

Eugene Kaspersky, Head of Anti-Virus Research at Kaspersky Labs, warned, "WinCE.Brador.a is a full-scale malicious program ready to go: unlike proof of concept malware, Brador has a complete set of destructive functions typical for backdoors."

Reportedly, the Brador.A author is offering the client portion of the Trojan for sell. This would not be the first commercial application spawned from malicious code. The notorious NetBus Trojan was repurposed as commercial spyware and the equally infamous Back Orifice Trojan was declared a remote access 'tool' by its creators, The Cult of the Dead Cow.

Brador.A is also not the first malware to impact portable devices. Palm.Liberty, discovered in August 2000, is a Trojan that attempts to delete all applications on Palm OS devices, then reboot the PDA. The Liberty Trojan was disguised as a crack to run Nintendo Gameboy games. In September 2000, Palm.Phage arrived on the scene, capable of infecting PalmPilot applications. More recently, in June 2004, the Cabir.A proof of concept virus demonstrated the ability to infect cellphones running the Symbian Series 60 operating system, which includes the Nokia 3650, 7650 and N-Gage phones. In July 2004, the WinCE4.Duts.A proof of concept virus was discovered. Duts, also known as Dust, demonstrated the ability to infect Pocket PCs or other devices running ARM processors.

Eugene Kaspersky notes, "Malware development for mobiles is passing through the same stages as malware for desktops: we will probably see a serious outbreak of viruses for handhelds sometime soon."

Fortunately, handheld protection is available from antivirus vendors, including:

• Kaspersky Labs offers antivirus software for the Pocket PC and Palm.
• BitDefender offers free antivirus software for Windows CE and Palm OS.
• F-Secure offers antivirus software for the Pocket PC and Nokia 9200 Communicator.