Malicious Windows Mobile Trojan Detected in China
Anti-virus vendor, McAfee has warned that they have detected a new Window Mobile PocketPC trojan that disables Windows Mobile application installation security. WinCE/InfoJack sends the infected device's serial number, operating system and other information to the author of the trojan. It also leaves the infected mobile device vulnerable by allowing silent installation of malware. The trojan modifies the infected device's security setting to allow unsigned applications to be installed without a warning.
The trojan was packed inside a number of legitimate installation files and distributed widely. It has been distributed with Google Maps, applications for stock trading, and a collection of games.
WinCE/InfoJack was created by a specific website. The website may have hired someone to create the trojan and distribute it to other sites. The maintainer of the website claims that the software was just necessary to collect information on the types of mobiles used to access their site. That would be easier to believe if they had notified the user prior to installation or if they had provided some sort of uninstallation method.
Fortunately the trojan's website is no longer reachable, due in part to an investigation by Chinese law enforcement after the trojan was detected as originating in that country.
Posted to the site on 26th February 2008