Killer text message found

Careful, that could be the SMS of doom

Security researchers in Holland have found a way to crash some Nokia mobile phones using a malformed text message.

The pernicious message exploits a bug in the Nokia phone software and, if received, will render some handsets completely unuseable.

Despite the discovery, anti-virus and security experts said that people should not be worried that a new era of SMS vandalism or hand-held viruses was about to strike.

They said that virus writers found it far easier to exploit the weaknesses of PCs and their users to spread computer viruses.

Lazy vandals

The troublesome SMS message was discovered by Job de Haas, a researcher at Dutch security firm ITSX. It affects Nokia 3310, 3330 and 6210 handsets.

Mr de Haas created the malicious message by tinkering with the parts of SMS that users do not see but tell a phone what to do with incoming text messages.

Kournikova: Tennis player and Visual Basic virus

Nokia claims it closed the loophole in its software late last year to ensure new phones could not be crashed by such messages. However, many older handsets could be still vulnerable.

Security experts said Mr de Haas's discovery would not kick off the long-anticipated spread of viruses to phone handsets and handheld computers.

The work involved in mastering the novel programs and technologies in phones and handheld computers is a good deterrent to most virus writers who tend to feed off the work that others have done, said Graham Cluley, spokesman for anti-virus company Sophos.

"If you look at the motivation of the average virus writer, they just want to spread their graffiti as much as possible," he said.

"They would rather spread a visual basic virus through the net because that's so trivial to do."

Visual Basic is a simple programming product from Microsoft that has become the tool of choice of many virus writers.

Some of the biggest viruses of the last couple of years, such as Melissa, I Love You, Kournikova and Goner, have been Visual Basic programs.

Mr Cluley said that Mr de Haas had exploited a bug in software to create the pernicious message rather than write a self-perpetuating virus that could hop from phone to phone unaided.

Remote control

He said before now only one virus had been found targeting handheld computers. The phage virus was created to attack Palm computers, but it only ever existed in a lab and had never been found in the wild, he said.

"Handheld viruses are more hype than havoc," said Mr Cluley.

Rory Tate, from the security arm of Scottish e-commerce firm Realise, said virus writers were bound to turn their attention to handhelds and phones as more computer power was packed into the gadgets.

Currently, the economics of the mobile phone world mitigated against malicious messages being spread across networks, he said.

"The only reason it's not been done before now is that the last thing a hacker wants to do is spend their own money to send a virus," he said.

He said that many phones could be remotely updated via SMS to sign them up to new services, a route that could be exploited on future phones by computer vandals.