Cabir & CommWarrior: The First Mobile Phone Worms (Bluetooth and MMS Propagation on Symbian)
In June 2004 F-Secure analysed Cabir, a proof-of-concept worm linked to the 29A virus-writing group and the first known worm for mobile phones, which spread between Symbian Series 60 handsets over Bluetooth; in March 2005 CommWarrior added self-propagation over operator MMS.
02Deep-Dive Technical Analysis
Cabir shipped as caribe.sis (caribe.app, flo.mdl, caribe.rsc) with autostart, displayed "Caribe", and pushed itself via Bluetooth to discoverable phones; the user still had to accept the transfer and install it. A bug made it lock onto the first device found. CommWarrior (2005) instead sent MMS messages with MIME type application/vnd.symbian.install to entries in the address book, using varied subject lines, and also spread over Bluetooth to randomly named SIS files, moving on if a target refused. This turned the carrier MMSC into a worm propagation channel.
03Vulnerability & Exploit Flow
Social-engineered installation of unsigned SIS packages pushed over Bluetooth and MMS from already-infected handsets.
04Recommended Defense & Mitigation Protocol
Set Bluetooth to non-discoverable, MMS gateway attachment filtering for SIS payloads, and Symbian Platform Security with mandatory application signing (Symbian OS 9).
05Security Impact & Geopolitical Consequence
Proved that smartphones and operator messaging infrastructure were a viable malware vector, prompting MMS content filtering, mobile antivirus products and, eventually, mandatory code-signing of mobile applications.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.