Hello everyone,
today we're taking a look at the Cabir Symbian OS worm.
This was the first piece of mobile phone malware which originated in the middle of June 2004.
Now bear with me as these displays keep going blank, I'm gonna have to keep waking them up a little bit here.
But we're going to send the worm over from my PC to the first phone you see on the left.
[soft phone beep]
And yes we will receive that.
[Cabir transfers silently over Bluetooth]
[phone vibrates and BEEPBEEP] Alright, we got one new message. Wonder who it's from?
[soft beeps of impending doom]
[reading] "Application is untrusted and may have problems. Install only if you trust provider."
Uh, yes. I trust me. "Install Caribe?"
So this is the name the author intended for this worm, but antivirus firms don't like to give authors the recognition they want,
and instead opt to rename the malware to something similar or in this case sort of rearrange and drop some letters.
So let's say yes, I want to install Caribe. And there is no certificate of course.
And details...Symbian OS version 1, not installed. Let's fix that. Install.
So... [beep]
This one just kinda hangs up once it runs. But Cabir has now infected this phone...
...there we go, we see "caribe" and...there we go! [beep from third phone]
Now we see a message on the right-hand phone, "receive message from [sic] Bluetooth from Nokia 6600?"
So as you might have guessed, that is the worm sending itself. And what it does is it picks one other phone in the vicinity
that has Bluetooth discovery enabled and tries to send itself to it.
And if we say no cuz I don't know who this is, and just wait for a bit, we're gonna see what happens.
[i sent you my worm, please respond]
[phone beeps] And here we see, about thirty seconds later, another popup: receive message?
Uh, no, I still don't know you, so I'm gonna say no.
[Cabir will not stand for this insolence]
[phone beeps yet again] And once again, about thirty seconds later like clockwork,
Cabir tries to send itself once again. So eventually you get fed up and you say "Alright fine, receive the message."
So it sends itself on over. [phone buzzes and BEEP BEEP]
Show...and just like the last one...we're going to install Caribe, say "yes," and install.
[and so Cabir began its journey to world domination, one Nokia at a time]
[thanks for sticking around during the rather boring installation process]
There we go, we see "caribe." And we've received "CARIBE.sis" and now THIS phone has picked up another new potential victim in the area.
So do we wanna receive it from the third phone? Of course, we do, yes!
[phone maliciously buzzes and BEEP BEEP]
And show...
[guess who's back, back again]
And this is how Cabir works: it picks one phone in the vicinity and sends itself over and over until the user eventually relents or leaves the area.
So you either get out of Bluetooth range of the infected phone, or you finally allow it to send the message to you.
[persistence is key, never give up Cabir]
Either way it's a bit annoying and persistent, which is what helped it to spread in the wild back in 2004.
And Cabir actually formed the basis for many other...well not MANY other, but a few other worms.
You can see on the left I've been trying a few different variants and none of them are particularly interesting.
This first one here is really the best one that I've found as far as functionality and simplicity and it just works right for a video.
[phone 3 angry mmBEEP] Oop, "App closed BTServer." I guess our Bluetooth connection was closed.
Well that's fun.
But like I was saying, this first 'A' variant, the original one from 2004 is really just the best one I found to make a video on.
And when you're on this Caribe screen nothing really works until you hit End and get out of the app.
So again, 2G networks are dead so these can't find a tower to attempt to verify their SIM card, which doesn't work anyway.
Which is why you see that message - it's not related to Cabir.
And removal of this particular worm is not too bad, we're gonna restart this phone here on the right.
[once again, I appreciate you joining me for this video]
We're gonna watch the, uh, usually buggy bootup sequence - it usually cannot get the full song out without stuttering and breaking up.
Kind of reminiscent of phone calls from that era.
[zing!]
[so how we all doing today? hopefully well]
[music tries to play, but just says "ding"]
So "ding," that's all you get. Usually it's supposed to play this nice little tune, but not anymore I guess.
[phone boots to Cabir, which it usually doesn't do]
[confused] Uh, what are we doing?
[softly] What...is happening?
Oh hey! Okay I've never seen that before - Cabir actually ran itself when we started the phone.
So normally it was pretty easy to remove cuz you just restart and then go into your little application manager and get out of it,
but in this case it's booting up, so that makes it a little more difficult to remove.
There were a variety of antivirus tools created to remove Cabir from phones, and their [Cabir's] eventual variants.
So it's not too much of a threat. It's not destructive to your data like something like the Skulls trojan, or BootTon.
But it is notable for being the first piece of mobile phone malware.
And from images I've seen, it is supposed to display the author's credit when this screen here is shown with the Caribe puzzle piece.
I've never been able to see that message actually show up, but I just wanted you to be aware that it exists.
And this was written by a member of 29A, a notorious VX group from the 90s and mid-2000s who wrote a lot of
impressive and otherwise technically complicated and novel stuff. In this case, the first piece of mobile phone malware.
Just an interesting little tidbit for you.
And that is about it for the Cabir Symbian OS worm, thank you very much for watching,
take care. :)