The Mobile Malware Researchers Association (MARA) today announced that it has characterized the first malware to cross-infect a handheld phone or PDA from a binary on the desktop PC. The malware, a Trojan dubbed "crossover", spreads from a Win32 desktop machine to a Windows Mobile Pocket PC handheld.

Details

virus name:  crossover virus - proof of concept
virus type: multiplatform

Target Platforms: Windows desktop OS's, Windows ce, mobile with .NET CF 1.1

This is a proof of concept virus that shows how a virus can spread from a desktop computer to a pocket pc. With the growing use of handheld devices this type of virus may become very prevalent in the future. For viruses to be more effective they need to spread across a wider range of devices including wireless devices.  AVers have to be able to provide adequate protection to deal with these types of viruses. The crossover virus is named so because it crosses over from wired PC's to wireless pocket PC's. It is the first virus of its kind.  When executed the virus checks what the current OS is, if it is not windows ce or mobile the virus makes a copy of itself and puts a startup command to the copy in the registry local-machine-current-version-run, the virus then quietly waits for an activesync connection to be detected, it can wait infinitely and everytime the desktop is rebooted the virus recreates itself and again add new copies to the registry, theoretically you can have so many copies running on startup it could degrade or halt the PC's performance. When an active sync connection is detected the virus copies itself to the handheld device and remotely executes the virus to start running on the device.

If the current OS is windows ce or mobile the virus erases all files in the \\My Documents directory of the device. Then it copies itself to the \\Windows directory and creates a shortcut to the copy in \\Windows\\startup .  When the device is reset the shortcuts execute their target files, here also you can theoretically have multiple copies of the virus running on startup. 

The crossover virus was written in C# (C Sharp) using Visual Studio .NET 2003, the Communications Library of openNETCF.org was used and a great help. It should run on any handheld device running windows ce/mobile and .NET CF 1.1

This is proof of concept code for educational purposes only. This virus closes the gap between handhelds and desktops, now its one big world open to all.

mobileav.org  via geekzone