MA-174.072009: MyCERT Alert - Transmitter.C Mobile Malware Advisory

1.0 Introduction

A new malware, named Transmitter.C, attacking Symbian mobile phones and distributed through a modified version of legitimate mobile application, has been intercepted by NetQin, the biggest mobile phone security company in the world.

2.0 Impact

Transmitter.C will be automatically started up and in just a minute and will automatically access network for about 3 minutes and later will send short messages externally at interval of 10 - 15 seconds and it is completely impossible to find the record of short messages that have been sent in the Sent Box.

Transmitter.C can automatically identify mobile phone languages and send different short message contents and attach a URL after each short message. Upon clicking on the attached links, the victim will download the malware to his/her mobile phone and becoming the next malware-spreader.

Transmitter.C can also transmitted in the form of legitimate third party software that is uploaded into the website and forum for downloading mobile phone software.

3.0 Affected Products

• Symbian S60 3rd Edition

4.0 Recommendation

Generally, doing the following shall mitigate infection and spread of Transmitter.C:

• Do not open questionable SMS and/or browse to unknown websites received via SMS from known or unknown person.
  
  
• Do not download and install unknown or untrusted third party application that is uploaded into the website and forum.
  
  
• Install and update antivirus product. A free edition of antivirus for Symbian can be obtained from NetQin at:
  http://www.netqin.com/english/product_download.jsp

MyCERT advises the users to be updated with the latest security announcements by the vendor. Users who receive suspicious SMS or URL can forward them to MyCERT for further analysis.

MyCERT can be reached through the following channels:

E-mail : mycert@mycert.org.my
Phone : +603 89926969 or 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : +60 19 2813801 (24x7 SMS reporting)
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: http://www.mycert.org.my

5.0 References

• http://www.netqin.com/english/market.jsp
• http://blogs.zdnet.com/security/?p=3713
• http://ddanchev.blogspot.com/2009/07/transmitterc-mobile-malware-in-wild.html
• http://cyberinsecure.com/mobile-malware-transmitterc-spreading-in-the-wild/
• http://www.prnasia.com/pr/09/07/09432411-1.html