An Internet Access Point, shortened IAP, is a “a collection of settings that define how a connection to a particular network is made” [1]. For example, it stores the Access Point Name (APN) for GPRS networks, the SSID for Wifi etc. On Symbian mobile phones, IAPs are stored in a table of the Communication Database.

In the SymbOS/Yxes worm (2009 / 2010), we had already seen the worm search through available IAPs on the mobile phone, select all outgoing WCDMA entries, add them to a list and silently use one of those to connect to Internet [2].

Since the beginning of summer 2010, we have also analyzed a bunch of malware that specifically looks for China Mobile’s IAP, and hence only fully work if the victim’s mobile phone is a China Mobile subscriber. This is the case of SymbOS/NMPlugin.A!tr, SymbOS/ShadowSrv.A!tr, SymbOS/Downsis.A!tr, SymbOS/Multidr.DC!tr, SymbOS/LinkHttp.A!tr …

For example, below, SymbOS/NMPlugin.A!tr parses all IAPs and counts those using cmwap (China Mobile WAP):

BL      GetAPNAndStuff ; returns the APN of an IAP
SUB     R0, R11, #apn
LDR     R1, =aCmwap     ; "cmwap"
BL      _ZN7TPtrC16C1EPKt ; TPtrC16::TPtrC16(ushort  const*)
SUB     R3, R11, #apn
SUB     R0, R11, #cmwapstring
MOV     R1, R3
BL      _ZNK7TDesC168CompareFERKS_ ; TDesC16::CompareF(TDesC16 const&)
CMP     R0, #0 ; compare the APN with "cmwap"
BNE     loc_1C358
...
loc_1C358
LDR     R3, [R11,#counter]
ADD     R3, R3, #1  ; increment counter if cmwap
STR     R3, [R11,#counter]

Even more sophisticated, we have now seen SymbOS/CReadMe.A!tr search the communication database for an IAP whose name is “CWAP(2)”, and if none are found, the malware adds China Mobile’s access points cmwap and cmnet.

Of course, this IAP can only be used if the victim’s phone has subscribed to China Mobile’s network. However, taking into account that end-users often have difficulties to configure their mobile phones to access Internet, this surely is a good idea for the malware to ensure its host is properly configured…

– the Crypto Girl

[1] I. Campbell, Symbian OS Communications Programming, 2nd edition, Ed. Wiley, 2007.

[2] See Appendix of A. Apvrille, Symbian Worm Yxes: Towards Mobile Botnets?, in Proceedings of the 19th EICAR Annual Conference, pp. 31-54, Paris, France, May 8-11, 2010

I had already seen mobile malware SMS messages with a malicious URL inside (e.g SymbOS/Yxes), or MMS messages (e.g SymbOS/Album.A!tr, SymbOS/Beselo!worm…) with a malicious attachment. However I had never noticed a mobile malware piece sending a WAP Push SMS (special SMS messages typically used to send ringtones, wallpapers, OTA provisioning etc).

The recent SymbOS/NMPlugin.A!tr does all three ! It sends:

- an MMS, whose title is “Hello Skuller”, and contains an attachment named Sunset.jpg

- a SMS containing a short message and a malicious URL from which to download another Symbian malware. This message is written in Chinese (it uses the UCS2 character set) and says something about some of your friends having uploaded two videos to the malicious URL

- a WAP Push SMS message, using China Mobile’s cmwap access point, and sent to UDP port 2948. This port is typically used for WAP Push Service Indication messages (WAP 167).

WAP Push Service Indication messages are special SMS meant to notify the end-user that a new service is operational at a given URL. Unfortunately, so far, the body of the message hasn’t been identified, so we cannot be sure this is what the malware is actually sending. However, if this is the case, a WAP Push Service Indication would be particularly dangerous for at least two reasons:

First, WAP Push messages are usually considered as high priority SMS and hence often automatically displayed on the mobile phone (see ‘signal-high’ parameter in WAP 167). For an attacker, this is nice because there are higher chances the message will be read by the victim.

Second, on some phones, a vulnerability prevents the phone from correctly displaying the originator of the message,so the victim may think the URI is sent by his/her (trusted) operator (see Figure below). For attackers, the downside is that WAP Push messages are not supported by all mobile phones.

Figure 1. Example of WAP Push SI message that does not correctly display the originator. The victim may consequently think the URL comes from a trusted party (system administrator).

– the Crypto Girl.

The analysis of SymbOS/NMPlugin.A!tr shows that, once again, a mobile malware was signed using the Symbian’s Express Signed procedure. It is the fourth malware we notice doing so since 2009 (and it is likely I missed a couple). See the table below.