Two new Trojan horse programs threaten to render some Symbian-based mobile phones totally useless.
The programs, Gavno.a and Gavno.b, masquerade as patch files designed to trick users into downloading them, said Aaron Davidson, CEO of SimWorks International.
Although almost identical with Gavno.a, Gavno.b contains the Cabir worm, which attempts to send a copy of the Trojan horse to other nearby Symbian-based phones via short-range wireless Bluetooth technology.
The Gavno Trojans, according to Davidson, are the first to aim at disrupting a core function of mobile phones – telephony – in addition to other applications such as text messaging, email and address books. "Gavno will effectively turn a mobile phone into a paperweight," he said.
Gavno.a and Gavno.b are proof-of-concept Trojan horses that "are not yet in the wild", Davidson said. "We were given an anonymous tip to have a look at them, which we've done. They're real."
Even though the Gavno Trojans aren't sophisticated programs, "they could still cause a lot of damage," Davidson said.
Gavno a, which is around 2KB in size, comes disguised in an SIS (Symbian Installation System) file, called patch.sis. Gava.b, which is slightly larger, is tucked inside the SIS file patch_v2.sis.
Davidson believes the Trojan programs originated in Russia.
The programs affect phones, such as Nokia's 6600 and 7610 models, using Symbian's OS version 7 with the Series 60 graphical user interface, according to SimWorks.
Not affected are Symbian-based phones such as the P900 and P910 from Sony Ericsson and the A925 and 1000 from Motorola. equipped with the graphical user interface from UIQ Technology. Also unaffected are Nokia's 3650 and Siemens AG's SX1, running Symbian OS version 6.x together with the Series 60 interface.
To fix infected phones, users will need to restore them to their factory settings, resulting in the loss of all personal data, such as phone book and calendar, according to Davidson.