New Trojan for Symbian Platform

December 23, 2004

Symbian anti-virus specialist SimWorks today announced that it has identified a new threat to Symbian phone users. The threat, METAL Gear.a encourages mobile phone users to install it by masquerading as a Symbian version of the popular Metal Gear Solid game and is the first Symbian Trojan to be identified which specifically targets Symbian anti-virus software.

SimWorks CEO Aaron Davidson says “The METAL Gear trojan is yet another example of the increasing sophistication of developers of malware for the Symbian platform. The METAL Gear trojan uses the same icon disabling technique pioneered by the recent Skulls trojan, this time to disable specific anti-virus and file browsing applications”.

Devices that have used the Symbian OS:
Nokia 9210/9300/9500 Communicator smartphone
Sony Ericsson P800/P900/P910
Nokia 7650/6600/7610.
Nokia 7710
Nokia N-Gage and Nokia N-Gage QD
It is also used on other manufacturers' phones, such as Siemens SX1 and Sendo X.

As with the Skulls trojans identified in November, the METAL Gear trojan also installs a version of the Cabir worm identified earlier this year. Unlike the Skulls trojan however Cabir will not seek to spread itself but rather a further file called SEXXXY.sis to any Bluetooth enabled phones in the vicinity. If a user accepts and installs the SEXXXY.sis file then it will disable the Symbian application selection button on their phone.

“Once a user installs either METAL Gear.a or SEXXXY.a they will find it quite difficult to repair. This is particularly so in the case of METAL Gear.a as it effectively disables all of the tools on the phone that a user would need to actually undo the damage caused by the trojan” says Davidson.

The METAL Gear and SEXXXY trojans are included in a file called METAL gear.sis. SimWorks Anti-Virus has been updated to provide protection from the METAL Gear and SEXXXY trojans.