'Metal Gear' : another Symbian OS trojan

A new trojan application has been identified by mobile antivirus-company Simworks. The threat is contained in a file called METAL Gear.sis which encourages mobile phone users to install it by masquerading as a Symbian version of the popular Metal Gear Solid game and is the first Symbian trojan to be identified which specifically targets Symbian anti-virus software.

SimWorks CEO Aaron Davidson says “The METAL Gear trojan is yet another example of the increasing sophistication of developers of malware for the Symbian platform. The METAL Gear trojan uses the same icon disabling technique pioneered by the recent Skulls trojan, this time to disable specific anti-virus and file browsing applications”.

As with the Skulls trojans identified in November, the METAL Gear trojan also installs a version of the Cabir worm identified earlier this year. Unlike the Skulls trojan however Cabir will not seek to spread itself but rather a further file called SEXXXY.sis to any Bluetooth enabled phones in the vicinity. If a user accepts and installs the SEXXXY.sis file then it will disable the Symbian application selection button on their phone.

“Once a user installs either METAL Gear.a or SEXXXY.a they will find it quite difficult to repair. This is particularly so in the case of METAL Gear.a as it effectively disables all of the tools on the phone that a user would need to actually undo the damage caused by the trojan” says Davidson.

The METAL Gear and SEXXXY trojans are included in a file called METAL gear.sis.

SimWorks Anti-Virus has been updated to provide protection from the METAL Gear worms. However, as with previous threats, the "normal" user not using warez/cracked applications is quite safe and does not need to fear this new trojan.