First Mobile Worm Cabir: History and Facts

Malware for smartphones appeared almost simultaneously with the smartphones themselves. However, in the early 2000s, they were still considered exotic - phones back then were much simpler and couldn't boast a wide range of features. Even at the peak of Android's popularity, the first malware consisted of classic trojans: infiltrating a phone disguised as some useful application, they sent SMS messages to premium-rate numbers or silently subscribed users to paid services. Nevertheless, the first full-fledged worm for mobile phones was detected long before that, on June 15, 2004. It was named Cabir.

Cabir's Propagation Mechanism

Cabir is a classic worm. Once executed on an infected phone, it first displayed the text line "Caribe" on the screen, from which it derived its name due to phonetic similarity. Then, the malware attempted to transfer its copy via Bluetooth to all nearby devices supporting the Object Push Profile mode. This technology is designed for transferring photos, music clips, and other files between various devices; it was supported not only by phones but also by some Bluetooth printers. Cabir sent its copy as a file with the .sis extension. For successful infection, the owner of the targeted phone had to, first, agree to receive the file, and second, run it. Upon doing so, Cabir saved itself to the "Apps" directory and began spreading from the new device.

Naturally, the Android operating system, which became the most popular among virus writers (after Windows), did not exist in 2004, so Cabir operated under Symbian OS. Cabir is considered one of the first pieces of malware specifically for mobile phones in history, and moreover, it is a worm, making it truly unique.

Vulnerabilities and Consequences

However, some older phones were configured by default to accept any files received via Bluetooth indiscriminately. Additionally, by continuously repeating transmissions, Cabir could constantly display messages on the screen offering to accept a file, rendering the phone unusable until its owner agreed to download the worm.

Interestingly enough, initially Cabir did not spread "in the wild." Its sample was sent to antivirus companies by the developer himself, attached to an empty email with no subject or explanatory text. The return address allowed identifying the creator of Cabir: it was Valtezz, a member of the international group of virus writers known as 29A, which had previously gained notoriety for distributing numerous malicious programs.

It is assumed that Cabir, which lacked any other malicious functions besides self-replication, served as a proof-of-concept sample demonstrating the practical possibility of worms existing for ARM processors and the Symbian operating system.

As a laboratory specimen, Cabir could not truly harm anyone, except perhaps draining the battery very quickly due to the constantly active Bluetooth module. But a couple of months later, the 29A group released the worm's source code publicly, leading to the emergence of numerous clones and forks.