Security threats Toolkit

Company struck down by CommWarrior

Tom Espiner ZDNet.co.uk

Published: 31 Aug 2005 09:40 BST

The first serious outbreak of a mobile virus in a company has been detected, according to antivirus experts.

F-Secure security expert Patrick Runald said on Tuesday that an outbreak of the CommWarrior.B virus occured at an unnamed Scandinavian company last Wednesday.

"This is the first time a mobile virus has infected an organisation," Runald said. "It's a particularly nasty version of CommWarrior as it just doesn't give up."

CommWarrior targets mobile phones that use the Symbian Series 60 operating system, and spreads over Bluetooth and as an MMS . Between 0800 and midnight, a phone infected with CommWarrior.A will attempt to spread the infection to other phones and between 0700 and 0800 it attempts to delete evidence of its activity.

"[ComWarrior.B] will continuously try to send itself for 23 hours out of 24," Runald said. "It's nastier than CommWarrior.A."

One of the company employees received CommWarrior.B to their phone, and then activated it by opening the program. "The virus then sent itself to every address in the address book, it was opened by more employees, who activated it and it spread" Runald said.

Warnings that the messages did not come from a secure source were ignored by employees.

"Fortunately this did not affect the operation of the company." said Runald. The operator at the company disabled MMS temporarily and Bluetooth was also disabled, which prevented the spread of the virus. The phones were then disinfected.

Runald recommended this approach if any other company was infected.