Ransomware attacks target Symbian mobiles

Kiazha.A removes all text messages and demands a ransom for their safe return

Researchers have discovered malware which holds mobile phone data to ransom.

The Kiazha.A code is currently targeting Symbian-based handsets in China.

The malware removes all sent and received text messages, and threatens to permanently cripple the handset unless users pay a fee.

Users are instructed to deposit a payment of around $7 in an account through QQ, a Chinese instant messaging and virtual currency system.

Kiazha.A is being distributed as part of a larger malware payload known as SymbOS/Multidropper.cr.

Other elements in the package automatically set up a QQ account for the user, and forward all text messages to the malware author. Users are charged for all messages sent by the malware.

"The interesting thing about multi-droppers is that they are usually compiled by malware authors who are not programmers and simply collect the work of others," wrote McAfee Avert Labs engineer Jimmy Shah in a blog posting.

"With MultiDropper.CR it appears that the author, with a lot of effort and testing, put together various malware-like pieces from a toolkit."

Shah also noted that the malware is profit driven, a rarity in the mobile malware field where authors mostly create attacks to gain notoriety.

Kiazha.A is the second major mobile phone attack to hit China in recent days after a malware infection targeting Windows Mobile handsets was discovered last week.

WinCE/InfoJack also attempts to steal information, but contains a component which leaves handsets open to future attacks.