New RedBrowser Trojan first to target J2ME

IDG News Service - Security researchers have discovered the first malicious software designed to work on mobile devices running the Java 2 Mobile Edition (J2ME) software, which is used by a large number of phones and consumer electronics products.

The malware, called RedBrowser, advertises itself as software that makes it easier for users to browse Web sites that use the Wireless Application Protocol technology, designed for small-screen displays. Once downloaded, the software starts sending unwanted SMS messages to a premium-rate number, costing the user between $5 and $6 per message.

Right now, RedBrowser appears to be an interesting "proof of concept" program, but it's not widespread, according to security researchers. Kaspersky Lab Ltd. has received only one sample of the browser, which targets mobile phone users in Russia, said Shane Coursen, a senior technical consultant at the Moscow-based security company.

The software is interesting, however, because it is the first to be designed for J2ME, Coursen said. "There have been malicious Java applets that run on PCs, but this is the first to run on these mobile phones," he said. "Java is a very widespread runtime environment, which gives the virus the potential to become widespread."

About 1 billion J2ME devices have been shipped worldwide, according to Java's creator, Sun Microsystems Inc. The software is included in Nokia Corp.'s and Motorola Inc.'s mobile phones, Research In Motion Ltd.'s BlackBerry devices, and many other products.

RedBrowser is also notable because it is the "first mobile malware that tries to steal money," and because it will also work on many low-end phones not previously targeted by malware writers, wrote Mikko Hypponen, director of antivirus research at F-Secure Corp., in a blog posting. Previous mobile viruses have targeted high-end smart phones running operating systems like Symbian OS, he said.

Hypponen and Coursen agree that the RedBrowser threat is limited because the software does not spread by itself. "It's got to be downloaded and run manually. It's not something that will just go from phone to phone with no interaction whatsoever," Coursen said.

The malware is also easy to delete from an infected phone, according to Kaspersky.

Sun executives were not immediately available to comment.