Symbian mobile worm spreading fast

SymbOS/Beselo is currently spreading through the wild in Asia, deceiving victims by posing as an image file.

The attack is launched via an MMS message in which the user is sent a file called either 'beauty.jpg,' 'love.rm' or 'sex.mp3'.

McAfee researcher Jimmy Shah explained on a company blog that the worm plays on the unique way in which SymbianOS runs application files.

Most operating systems will match a file with its preferred application based on the file extension. A file ending in .jpg will be loaded inside an image viewer, while a .exe file will be recognized as an application.

Symbian, however, does not load files based on extensions. Even though the worm may have a .jpg extension, it is still recognised and loaded as an application, said Shah.

On being launched, the worm copies itself into the user's memory card and sets itself to load on startup.

The malware then attempts to send itself to every contact on the user's phone. It also generates random numbers to send itself to and attempts to spread to any nearby device via Bluetooth.

Because the infectious message will often come from a friend or trusted contact and is not obvious as an application, Shah warned that the malware could have a very high rate of infection.

"The message says 'photo' and it comes from a friend, so the user is likely to open it to see the photo," he wrote.

"When the request to install pops up, it's very likely the user will click OK and be infected."