F-Secure, the Leader in Mobile Security Discovers First Cell-Phone Breach - Industry Trend or Event

Cambridge Telcom Report, June 12, 2000

F-Secure Corporation (Helsinki: FSC), a leading provider of security for mobile, distributed enterprises, is warning e-mail users of a new e-mail chain letter: the VBS/Timofonica worm. This worm is similar to the LoveLetter worm that went around the world in early May. However, this new worm activates by sending SMS short messages to random GSM phones. F-Secure Anti-Virus detects and disinfects the virus, with the latest update available from www.F-Secure.com.

"This is the first ever virus to do anything with mobile phones," explains Mikko Hypponen. "However, this is not a mobile phone virus -- it does not spread through phones, it just sends annoying message to them."

VBS/Timofonica operates under the Windows operating system and needs Microsoft Outlook to spread itself further via e-mail, much like the LoveLetter virus. The e-mail messages sent by Timofonica are as follows:

From: name-of-infected-user To: random-name-from-address-book Subject: TIMOFONICA Content: Es de todos ya conocido el monopolio de Telefonica pero no tan conocido los metodos que utilizo para llegar hasta este punto. En el documento adjunto existen opiniones, pruebas y direcciones web con mas informacion que demuestran irregularidades en compras de materiales, facturas sin proveedores, stock irreal, etc. Tambien habla de las extorsiones y favoritismos a empresarios tanto nacionales como internacionales. Explica tambien el por que del fracaso en Holanda y que hizo para adquirir el portal Lycos. En las direcciones web del documento existen temas relacionados para que echeis un vistazo a los comentarios, informes, documentos, etc. Como comprendereis, esto es muy importante, y os ruego que reenvieis este correo a vuestros amigos y conocidos.

Attachment: TIMOFONICA.TXT.vbs The Spanish text speaks critically about the monopoly of the Spanish telecom operator Telefonica, and urges users to open the attachment to see more information on the subject. It also asks users to forward this e-mail to all their friends. The word "Timofonica" itself is a joke on Telefonica word "Timo" means trick in Spanish.

What makes Timofonica special is that it also sends e-mail messages to an E-mail-to-GSM gateway in Spain. As a result, the virus might send this SMS message to thousands of random GSM numbers: informa que: Telefonica te esta enganando.

This text means "Note: Telefonica is cheating you." "This seems to be a political virus," comments Mikko Hypponen, Manager of Anti-Virus Research at F-Secure Corporation. "Apparently the virus is trying to protest against the Telefonica company -- and it attempts to do this by sending the message directly to people's mobile phones."

Currently, there's no information on where the virus may have originated from. There are no obvious clues in the source code of the virus other than that it's obviously written in Spain.

So far, F-Secure has received reports of this new virus only from Spain. Apparently the SMS gateway will only send messages to GSM phones using the Telefonica Movistar network, most likely limiting the exposure to Spanish users only.

F-Secure Corporation launched F-Secure Anti-Virus for WAP Gateways in Febuary 2000 to protect WAP mobile phone systems against virus attacks.

A technical description of this virus is available in the F-Secure virus description database at: http://www.F-Secure.com/v-descs/timofon.htm

F-Secure Corporation is a leading developer of centrally managed security solutions for the mobile, distributed enterprise. The company offers a full range of award-winning integrated anti-virus, file encryption, distributed firewall and VPN solutions. F-Secure products and the underlying policy management framework enable corporate IT departments as well as service providers to deliver Security as a Service. For the end-user, Security as a Service is invisible, automatic, reliable, always-on, and up-to-date. For the administrator, Security as a Service means policy-based management, instant alerts, and centralized management of a widely-distributed user base.

Founded in 1988, F-Secure is listed on the Helsinki Stock Exchange. The company is headquartered in Espoo, Finland with North American headquarters in San Jose, California, as well as offices in Canada, China (Hong Kong and Beijing), France, Germany, Japan, Sweden and the United Kingdom. F-Secure is supported by a network of VARs and Distributors in over 90 countries around the globe.

CONTACT: Dan Takata, Manager, Training Division of F-Secure Corporation, 408-938-6700, or fax, 408-938-6701, or Dan.Takata@F-Secure.com; or Paula Dunne, Vice President of Neale-May & Partners, 650-328-5555 ext. 107, or fax, 650-328-5016, or pdunne@nealemay.com, for F-Secure Corporation; or in Finland, Mr. Mikko Hypponen, Manager, Anti-Virus Research of F-Secure Corporation, 358-9-8599-0513, or fax, 358-9-8599-0599, or Mikko.Hypponen@F-Secure.com.