First Cell Phone Java Trojan On The Loose

Alerts went out Tuesday from several security companies warning users of an in-the-wild Trojan horse able to infect nearly any cell phone.

The Trojan, named Redbrowser.a by McAfee, F-Secure, and the discovering vendor, Moscow-based Kaspersky Labs, can attack any device -- smart phone, PDA, or cell phone -- that runs Java 2 Micro Edition (J2ME), Sun Microsystem's version for consumer electronics devices.

"The important thing about this Trojan is that it can get to any device that runs J2ME," said Shane Coursen, a Kaspersky senior technical analyst. "A good portion of cell phones use Java for games, and some of their other programs."

Redbrowser.a appears on a device as a text message with an accompanying file attachment. The file claims it's a program that lets users visit WAP sites without a connection. In reality, the Trojan installs code that sends out text messages to premium-rate phone numbers in Russia. The user's charged $5 to $6 for each message.

According to the alert posted by McAfee, the Trojan's text sending function doesn't work in the U.S. "We are currently assuming this is due to the numbers dialed being local to Russia," the alert read.Coursen wasn't able to identify the perpetrators, nor their motivation for creating the Trojan. One possibility, he said was that they might be connected to the premium numbers. "There's no evidence of that," he cautioned, but acknowledged that similar scams have been run in the past by attackers who planted auto-dialers on unsuspecting users' PCs, then raked in fees when those dialers rang up 900 numbers over a land line.

Most anti-virus vendors, including Kaspersky, have labeled Redbrowser.a as a low-level threat. "There's no global outbreak going on," said Coursen.

But it is, he said, another indicator that malicious code writers are expanding into mobile territory. "We are finding that there are mobile viruses out there," he said, "and I believe we're moving toward a real threat."

Kaspersky, F-Secure, and McAfee all sell products aimed at protecting mobile users from worms, viruses, and Trojans.