ICE virus hoax

In 2005 a chain letter circulated across the internet urging mobile phone users to add a special number to their cell phone directory in case they had an accident and next of kin details could not be found.

The chain letter advised recipients to enter an "ICE" (In Case of Emergency) entry to their directory of phone numbers which could be used by emergency staff if required.

The campaign, started by British paramedic Bob Brotchie who works for the East Anglian Ambulance Service, was launched in early 2005.

Shortly afterwards, hoax messages began to spread across the internet claiming that ICE was a virus.

East Anglian Ambulance Service have confirmed that rumours of ICE being a virus are a hoax.

More information about the real ICE campaign can be found at www.icecontact.com

A typical text of the ICE hoax reads as follows:

Be very careful with this one [ICE]. Although the intention is great, it is unfortunately Phase One of a phone based virus that is laying a path for propagating very quickly. Passing it on is part of the virus. Interestingly, such is the deviousness of the people who write these things.

We have already seen the 'Second Phase' where a program is sent as part of a ringtone download that goes into your addressbook and looks for something it recognises. You've guessed it, an address book entry marked "ICE or I.C.E." or whatever. It then sends itself to the 'ICE list', charging you for the privilege.

Another version of the hoax reads as follows:

Latest Mobile Phone Scam

I have just received information that there is a new mobile phone scam concerning Pay as You Go (PAYG) Mobiles.

The scam is that you are asked to set up an "In Case of Emergency (ICE) Account" on your PAYG mobile.

Apparently this is a modular system that searches for the word ICE text and then changes your phones setting and takes any PAYG credit left on your phone.

Please ensure that this information is circulated to all staff and please pass on to family and friends

Many virus hoaxes:

• falsely claim to describe an extremely dangerous virus
• use pseudo-technical language to make impressive-sounding (but impossible) claims
• falsely claim that the report was issued or confirmed by a well-known company
• ask you to forward it to all your friends and colleagues

As usual, you are urged not to pass on warnings of this kind, as the continued re-forwarding of these hoaxes simply wastes time and email bandwidth.

It is possible that you may receive a hoax via email with a file attached. Obviously, such file attachments should be treated with caution as they may be virus infected. Sophos recommends deleting virus hoax emails, whether they contain file attachments or not.

Sophos suggests a policy to help prevent hoaxes from spreading in your company.