KASPERSKY LAB DETECTS GROWTH OF THE FIRST SMARTPHONE TROJAN TO TARGET SYMBIAN OS

Kaspersky Lab, a leading provider of security solutions that protect against viruses, Trojans, worms, spyware, crimeware, rootkits, phishing, hacker attacks and spam, today reported that it has detected a Trojan targeting the Symbian operating system. The Online Scanner Top Twenty chart for June 2008 highlights that the Trojan is attacking the platform that currently accounts for 72.4% of the global smartphone market.

Entering the chart at ninth position, Trojan.SymbOS.Skuller.gen is one of the oldest Trojans for Symbian OS, replacing all file icons with a skull. Yet despite its age, the success of the Symbian platform and the exponential uptake of smartphones - 115 million smartphones were sold worldwide in 2007 and analyst group Canalys predicts that global shipments will reach one billion by 2012 - has seen the malicious program become prolific.

Senior Technology Consultant at Kaspersky Lab, David Emm comments, “In May 2008 the Metropolitan Police published statistics stating that up to 10,000 mobile devices are stolen each month. But, phones don’t need to be physically stolen to be the subject of theft.” He adds, “In most cases the data held on smartphones is worth far more than the device itself, and for this reason the level of protection you put in place should be as high as the level of protection you would put in place on your laptop or PC. ”

Launched earlier this year, Kaspersky Mobile Security 7.0 offers powerful protection for data stored on Symbian and Windows Mobile-based smartphones in the event that the device is lost, as well as protecting against network attacks, malware and SMS spam. The software allows users to completely block a lost device or to remotely delete all the data on it. Moreover, if a smartphone is stolen, the SIM-Watch function prevents the thief from accessing data on the phone without the original SIM card; as soon as the original SIM card is replaced, a message notifies its owner of the new telephone number. 

Two other new entries targeting non-Windows platforms entering The Online Scanner Top Twenty for the first time in June were Trojan.Mac.Dnscha.d (3rd in the chart) and Trojan.Mac.Dnscha.e (6th in the chart). “The fact that other non-Windows platforms are becoming so popular among virus writers means that the usual leading platform, Win32, is now being challenged for the first time,” observes Senior Virus Analyst with Kaspersky Lab, Alexander Gostev.

In addition, utilities that aren't themselves malicious but are used by other malware to obtain confidential user information, or interfere with the smooth functioning of the victim’s machine were still common among the programs detected by the Online Scanner throughout June. Such programs are classified as not-a-virus and these were present in 4th, 5th, 10th, 15th, 16th and 20th places.

The file viruses that flooded the Online Scanner Top Twenty last month still remain a real threat with Virus.Win32.Virut.q rising from 10th to 7th place and Virus.Win32.Virut.n still in the top five. However, Net-Worm.Win32.Allaple.b and Net-Worm.Win32.Allaple.e that entered the chart in high positions in May have disappeared from the June rankings altogether.

In contrast, the statistics in The Virus Top Twenty indicate that the malware authors’ holiday season that started in May continues in June; Email-Worm.Win32.NetSky.q continues its reign at the top of the chart as it has since the beginning of the year. The first of only two significant entries to The Virus Top Twenty chart is the worm Net-Worm.Win32.Nimda in at 16th position. Gostev notes that, “Nimda is a nasty piece of malicious code that first surfaced in 2001. It is a versatile worm that spreads not only via email, but across network drives on local area networks and also attempts to attack the IIS servers on the network.” He adds, “It leaves a computer wide open to anyone by adding a Guest user to the Administrators group and making local disks accessible by other computers on the network.”

The second significant threat is Exploit.Win32.IMG-WMF.y. Exploits being sent by email pose a serious threat to users, as some email clients display media content without first prompting the user. This exposes the computer to automatic infection. The user doesn't need to give permission for the attachment to be saved or run ­­the malicious code will execute automatically when the user views the message.

The Virus Top Twenty in June also reports that that the UK has risen from ninth place - where it accounted for 2.83% of the origin of global infected email messages in May 2008 - to seventh and 4.28% of the worldwide total. The US remains at the top of the global ranking with 18.95%, responsible for 18.95%, followed by South Korea with 7.97% and China with 5.79%.

The Online Scanner Top Twenty – June 2008

The Virus Top Twenty – June 2008

For further information regarding the June 2008 Kaspersky Lab Online Scanner Top Twenty and The Virus Top Twenty please visit: http://www.kaspersky.co.uk/news?id=207575657 and http://www.kaspersky.co.uk/news?id=207575656.