Hello everyone,
today we're taking a look at the BootTon Symbian OS trojan.
This trojan actually arrived on your mobile phone from a modified mobile phone worm,
which would spread this trojan to exactly one other phone
and then both phones would be incapable of spreading the trojan or the worm any further.
So that [worm] was called OneHop, unfortunately the copy I have does not work.
I tried to run it, but it did not actually do anything - it's just corrupted.
So we're going to just take a look at the trojan component.
And bear with me here if my finger gets in the way, it's quite awkward recording this tiny screen
[phone beeps softly] and trying to manipulate the physical buttons without the phone going everywhere off the frame.
Alright.
I am sending over BootTon now from my PC,
yeah I want it - of course I want it! So we're gonna let that transfer.
[phone buzzes and loudly beeps as BootTon arrives]
Got that heavy duty vibration on these old phones.
So let's take a look at our messages. So now we have BootTon.sis,
and we're going to install it. So this is the trojan that you would receive from one other mobile phone due to the worm component.
[phone beeps gently]
And then both phones would have BootTon. So "application is untrusted and may have problems,
install only if you trust provider."
I trust me. "Install ILoveU?" Oh, this is sounding familiar.
I'm getting flashbacks to a particular, uh, worm, from the year 2000.
We're going to install - maybe we should view the details before we install this.
[reading aloud] Symbian OS, yeah, ILoveU, version one point oh point oh. Application unknown, unknown, not installed.
Alright how 'bout the certificate? Oh.
[sarcastically] I'm sure it's fine.
Okay here we go, ILoveU and then "Thunderbird."
Here we go, it's installing.
[SymbianOS chugs along towards certain doom]
Can't wait to have this application.
[Beeeep]
Oh boy, installation complete! Maybe it's a new game, or some app I really wanted.
[soft beeps] Aaaand let's see. [louder beep]
[reading] "SIM card registration failed," that's just because this phone can no longer attempt to communicate with the 2G towers, and unfortunately no longer functions as a phone.
But, it functions as a video machine, and uh oh!
I don't remember "Messaging" saying "I-Love-U" with this little T heart icon.
[beep beep forever]
"RealOne" still here, "Services," "Video recorder," and "Calendar" are good, but we have I-Love-U icons in place of several original applications.
Alright, the only thing I care about is if Snake still works, so let's see.
Ooh, it's looking good!
Alright excellent, we can play Snake.
Still works!
[hooray!]
That is fortunate. Unfortunately, I can't really [snake explodes violently] control it very well, uh, with one finger,
while attempting to make this video, but...
...you gotta trust me that I am a Snake champion [not really],
I got a lot of practice back in the day.
Alright, so now that BootTon has been installed on our phone,
we're gonna try and launch the camera. [soft beep]
Hmm...
This does not look like the camera to me, in fact the phone is restarting, so that's not good.
[happy beep]
Well it beeped.
Hey, our phone is back! Okay, so we're good here, we're still failing to register the SIM card.
Oh, one new message! That must be the OneHop worm that I tried to transfer over. Let's see.
[Symbian rolls over and dies]
Oh.
Well, shoot. The phone rebooted again.
Well I guess we'd better sit here and wait.
[happy beep, alive once more]
There we go, we're back into Symbian OS, okay.
I don't wanna see that message, I know what happened last time.
How about we just look at our applications?
[RIP Symbian]
Oh...I should've known.
[thanks for joining me for this video]
[beep, you can't kill a Nokia]
So we're back once again, but unfortunately the only thing your phone would be capable of doing now is
making or receiving phone calls.
It is now purely a dumb personal phone without any of the fancy applications or games or camera phone.
[no selfies, only reboot-ies]
I forgot how short the duration is for the screen being on so you didn't drain all your battery life back in the day.
So we'll exit out of that because we know we're not going to get anywhere with any of these applications.
Gotta press the button every now and then so the phone screen stays alive.
[life is hard]
So what BootTon did was replace a bunch of default operating system files and programs like the camera
and the menu for the applications and messaging and all of that,
with a corrupted version that reboots the phone when you open them, which is why we kept restarting
every time we tried to do...anything.
And with that your phone becomes pretty much completely unusable until you format it and reinstall the operating system.
There were some antivirus programs for SymbianOS, however you needed to have it installed and ready to go
before you rebooted the phone for the first time, which is pretty difficult when things you try to run end up rebooting the phone anyway.
And BootTon actually has this image embedded within it,
along with the text that says - no it doesn't say "SIM card registration failed," it says:
[reading] Saying hello from here, Syria, to all the world, I wish you n-joy your damaged device,
You know not all may read these words, but no problem because some will.
But even this, that's the way I love you all, winky smiley face, regards, Thunderbird."
You might recall the "Thunderbird" text we saw when we first installed the trojan.
So this is a message from him within the trojan itself.
Functionally the worm and trojan are actually modifications of already-existing Symbian OS malware.
The worm component is a modified version of Cabir, which we will take a look at soon,
and the trojan is a modified version of the Skulls trojan which I've looked at previously on this channel.
So if you wanna check out some other SymbianOS malware you can search for "SymbOS" like in the title here,
and you should find it pretty quickly. I think I have three or four older videos on it, which you might find interesting if you liked this video.
So now that our phone is pretty much unusable, I'd better wrap this up.
That is about it for the BootTon Symbian OS trojan.
As well as the, um, unavailable OneHop Symbian OS...
...sort of worm, I guess. If it only spreads to one other phone you can't really call it a true worm, can you?
I dunno, but at any rate, that's about it for the BootTon Symbian OS trojan,
thank you very much for watching,
take care. :)