Antivirus labs in Russia and Finland have identified a new e-mail virus that sends spam, or mass amounts of unwanted e-mail, to mobile phones.
The “Timofonica” worm, which originated in Spain and sends an e-mail message in Spanish, appears to have been developed as a protest against Spain’s dominant telecommunications provider, Telefonica.
Timofonica spams phones connected to Spain’s Movistar mobile phone service, according to Kaspersky Lab, an antivirus company in Moscow, and F-Secure Corp., a similar operation based in Espoo, Finland. The worm spreads via e-mail to other computers while at the same time sending annoying messages to mobile phones, according to Kaspersky.
The worm uses Microsoft Outlook to send itself to all addresses stored in the MS Outlook Address Book, and for each infected message sent, also sends a message to a randomly-generated telephone number at the Spanish cell phone operator’s Web site, correo.movistar.net. That address is an SMS gateway that sends SMS messages to mobile phones.
Notably, the worm is written in Visual Basic scripting language and will only work on computers on which the Windows Scripting Host and MS Outlook 98 or 2000 is installed. However, that may be a broad number of PCs in use, since Windows Scripting Host and those versions of Outlook are installed by default in all Windows 98 and Windows 2000 operating systems.
New Form of Protest
According to F-Secure, Timofonica’s text “speaks critically about the monopoly of the Spanish telecom operator Telefonica, and urges users to open the attachment to see more information on the subject.” The e-mail also urges recipients to forward the message to friends.
“The word ‘Timofonica’ itself is a joke on Telefonica,” F-Secure says, noting the word “Timo” means “trick” in Spanish.
The message sent to mobile phones, also in Spanish, translates to “Note: Telefonica is cheating you,” F-Secure says. Beyond that clue, the antivirus companies say there is little information on where the worm originated from, and the source code contains no obvious leads.
Both F-Secure and Kaspersky say their antivirus software data files have been updated to kill Timofonica.
Limited Reach, So Far
F-Secure said it has received reports of the new virus only from computer and mobile phone users in Spain, probably because the SMS gateway the worm employs only accesses phones using the Telefonica Movistar network. The antivirus companies said they believe Timofonica is the first virus to attack mobile phones, though they warn that with the increasing use of phones for messaging and Internet access, they could present a new frontier for hackers as well as commerce and communication.
However, F-Secure is cautioning mobile phone users against paranoia about their devices. “This is not a mobile phone virus — it does not spread through phones, it just sends annoying messages to them,” the company said.