New RedBrowser Trojan first to target J2ME

Security researchers have discovered the first malicious software designed to work on mobile devices running the J2ME (Java 2 Mobile Edition) software, used by a large number of phones and consumer electronics products.

The malware, called RedBrowser, advertises itself as software that makes it easier for users to browse Web sites that use the WAP (Wireless Application Protocol) technology, designed for small-screen displays. Once downloaded, the software starts sending unwanted SMS messages to a premium-rate number, costing the user between US$5 and $6 per message.

Right now RedBrowser appears to be an interesting "proof of concept" program, but is not widespread, according to security researchers. Kaspersky Lab has received only one sample of the browser, which targets mobile phone users in Russia, said Shane Coursen senior technical consultant with the Moscow-based security company.

The software is interesting, however, because it is the first to be designed for J2ME, Coursen said. "There have been malicious Java applets that run on PCs but this is the first to run on these mobile phones," he said. "Java is a very widespread runtime environment, which gives the virus the potential to become widespread."

About 1 billion J2ME devices have been shipped worldwide, according to Java's creator, Sun Microsystems Inc. The software is included in Nokia and Motorola's mobile phones, Research in Motion's BlackBerry devices and many other products.

RedBrowser is also notable because it is the "first mobile malware that tries to steal money," and because it will also work on many low-end phones, not previously targeted by malware writers, wrote Mikko Hypponen, director of antivirus research with F-Secure, in a blog posting. Previous mobile viruses have targeted high-end smart phones running operating systems like Symbian OS, he said.

Hypponen and Coursen agree that the RedBrowser threat is limited because the software does not spread by itself. "It's got to be downloaded and run manually. It's not something that will just go from phone to phone with no interaction whatsoever," Coursen said.

The malware is also easy to delete from an infected phone, according to Kaspersky.

Sun executives were not immediately available to comment.