First virus for Windows CE surfaces

[SDK]

A virus that infects Windows CE has been developed--the first such bug discovered for the handheld operating system, according to one firm.

BitDefender, based in Romania, stated that it has discovered a "proof of concept" virus for Microsoft's operating system for smart phones and other handhelds. The malicious code's author, who uses the pseudonym Ratter, is part of the 29A VX group that created a virus for the Symbian OS.

BitDefender said it is the first known Windows CE virus. Microsoft could not be reached for comment.

"The same as the creators of Cabir (the virus for Symbian OS), the initiator has not designed it to propagate on a massive scale but rather to demonstrate that devices running Microsoft Windows CE can be infected by malicious code," Viorel Canja of BitDefender said in a prepared statement. "The code was first sent to antivirus experts instead of being released in the wild."

Several analysts have speculated that handhelds and even VoIP phones could become major targets for virus writers, but so far, massive outages have not occurred.

Users have to download a piece of software to propagate Cabir; experts have concluded that it won't get far.

The Windows CE virus displays a message box, asking for the user's permission to spread to other files.

Despite the paucity of wild viruses, antivirus companies and hardware manufacturers have been preparing products to make handhelds more secure in advance of a potential increase in attacks.

Source : http://zdnet.com.com/2100-1105_2-5273168.html

[NeonWizard]

In the end, someone will probably invent a virus for any OS. They got one for Windows CE, and 64 bit. Too bad we can't stay away from people who write malicious code.

[Cybr1d]

aaaaaack! My cell phone runs on Windows CE...that sux. So are they coming up with an antivirus for phones now?

[NeonWizard]

They have to, unless we'll be again in the stone age.

[Spyder32]

Some more information from Zone-H.org:

The first known virus for the Windows CE operating system has been developed and sent to anti-virus companies.

The virus, known as WinCE4.Dust, does no direct damage to the system. When it's executed, according to descriptions from several anti-virus companies, it asks, "Dear User, am I allowed to spread?" Symantec ( http://www.symantec.com/avcenter/ven...ce.duts.a.html ) notes that if the user responds affirmatively, "it will attempt to append itself to all non-infected EXE files in the directory which it is currently running." F-Secure's analysis of the virus ( http://www.f-secure.com/v-descs/dtus.shtml ) indicates that it only infects files larger than 4,096 bytes.

A variety of spellings of the virus name are being used, including "Dust," "Duts" and "Dtus." A screen shot of a file dump of a portion of the virus in F-Secure's analysis shows the quote "This code arose from the dust of Permutation City" embedded in the virus. The analysis declares this to be the origin of the virus' name, but then goes on to call it both Duts and Dtus. The virus also contains this string: "This is proof of concept code. Also, i wanted to make avers happy. The situation when Pocket PC antiviruses detect only EICAR file had to end ..."

The first report of the virus came from BitDefender ( http://www.bitdefender.com/bd/site/v..._id=1&v_id=282 ), whose Lab Director Viorel Canja said: "This is a common excuse for virus writers, to pretend that they create viruses in order 'to make avers [anti-virus producers] happy'. Making viruses doesn't make anyone's life happier, as it's making it harder and harder to live for the ordinary user."

Similar proofs of concept for new platforms have emerged in the past, but they were not necessarily followed by actual attacks. Just last month a conceptual virus for cell phones running the Symbian operating system was developed.