First Malicious Worm Hits the iPhone
PrintIt didn't take long for hackers to take advantage of a potentially dangerous exploit affecting jailbroken iPhones. The vulnerability first gained notoriety earlier this month when a hacker from the Netherlands took control of modified iPhones and sent the owners an SMS requesting a fee for instructions on how to protect thier device. He later backed down and posted the fix for free, but by then, the cat was out of the bag.
Fast forward a few weeks and we now have the first malicious worm making the rounds on jailbroken iPhones and iPod touch devices. According to reports, the worm uses command--and-control like a traditional PC botnet. it configures two startup scripts, one of which is used to execute the malicious worm during boot, and the other to make a connection to a Lithuanian server in order to upload stolen data and hand over control to the bot master.
The worm works by changing the root password from the default of "alpnie" that Apple put in place in the factory firmware. It attacks IP ranges from a wider range of ISPs, including UPC, Optus, and T-Mobile.
The recommended fix is to restore jailbroken iPhones to the current Apple-supplied firmware.
More like this
Khaled
November 25, 2009 at 2:13am
It's like having a Linux system with a blank root password. Should we blame the OS or the user?
Caboose
November 25, 2009 at 7:51am
Blame the user. It's your responsility to secure your OS. Just like if you leave your house or car unlocked, and someone steals stuff, you can't hold the car company or house manufacturer responsible for your fault.
-= I don't want to be dead, I want to be alive! Or... a cowboy! =-
Caboose
November 23, 2009 at 7:46pm
Dear Apple Users;
This just proves that Apple products are NOT immune to people with malicious intent. Windows is attacked more often because it is the most widely used OS on the market. iphones have the spotlight when it comes to "Smart" phones. And when YOU don't take steps to protect yourself, this is what happens.
I hope you learn your lesson, but I'd bet a year's paycheque that, that will never happen!
Yours Truely,
A Secured Windows User.
P.S. Notice I didn't use the term "PC"? That's because a Mac is a computer, and when it's used for personal use, it's a personal computer, thus Macs fall in to the PC category.
-= I don't want to be dead, I want to be alive! Or... a cowboy! =-
Righteous Fury
November 23, 2009 at 2:08pm
I don't know about you guys, but that Droid just keeps getting sexier... especially since a friend of mine saw my wife looking at them over the weekend... I can't wait to open my presents!!!
aviaggio
November 23, 2009 at 12:44pm
Wait... so the recommended fix is for all jailbroken iPhones to be un-jailbroken??? Kinda makes them useless then, no? Unless of course Apple hijacked the worm and let it loose just so it could stop jailbroken iPhones from working. I wouldn't put it past Jobs for a second.
Anyone else smell dogsh*t here???
Khaled
November 25, 2009 at 2:15am
No, the solution is: CHANGE THE ROOT PASSWORD...
Root btw is the Administrator account in unix/linux based systems.
nekollx
November 23, 2009 at 10:06am
So what? This http://www.maximumpc.com/article/news/first_virus_hits_jailbroken_iphone
isn't considered what
Malicious?
A Worm?
First?
------------------------------
Coming soon to Lulu.com --Tokusatsu Heroes--
Five teenagers, one alien ghost, a robot, and the fate of the world.
Paul_Lilly
November 23, 2009 at 10:54am
This is the first (known) malicious worm to hit the iPhone. Whereas the previous one hit jailbroken iPhone users with a Rickroll, this one acts like a botnet and is redirecting some online banking customers to lookalike websites. BBC News actually has a pretty good read on this one, found here.
-Paul Lilly
nekollx
November 23, 2009 at 11:01am
so again why is this "first"
Both previous cases were jailbroken iPhone, just like this one.
Why does this get to be "first" for the 3rd time.
------------------------------
Coming soon to Lulu.com --Tokusatsu Heroes--
Five teenagers, one alien ghost, a robot, and the fate of the world.
nekollx
November 23, 2009 at 12:49pm
But it's not the first or new. It's the EXACT SAME exploit in the SSH root as the other two. Only a new application. There is NO difference between this injection vector and the past 2 cases. So it can't be "the first"
Look my concern is the messange this sends to people not keeping up. "oh it's only the first one, it's not wide spread."
But their's been 3 seperate attacks, malisious or not, 3 different people used the same exploit. saying "the first" devalues the danger present
------------------------------
Coming soon to Lulu.com --Tokusatsu Heroes--
Five teenagers, one alien ghost, a robot, and the fate of the world.
mesiah
November 23, 2009 at 10:01pm
Your splitting hairs. I don't know if you are doing it because you are truly stuck on the fact that the vulnerability itself has been used before, or if you are doing it just to be a douche bag. The headline of the article is 100% correct. The argument you are making is the same argument that AT&T is trying to make to stop the "there's a map for that" commercials. You are inferring that the average person is too stupid to realize the difference between "the first attack" and "the first malicious attack" The first paragraph of the article clearly states that this is not the first occurrence, but merely the first time it has been used to cause real harm. Whether or not you like the headline doesn't matter, it is fact, and I don't believe it was meant to be misleading, merely eye catching.
nekollx
November 24, 2009 at 10:41am
and the first paragraph covers only 1 of the 2 attacks. And this is nothing like ATT. They say "well we have EDGE" I'm saying, "the exact same vunerability was exploted TWICe before" and yet everytime there is a article about this EXACT SAME injection vector it's being called "the first" which sets a image to those not tracking everything that "Oh it's not so bad, just one guy" when it facts its /3/ guys exploiting the flaw.
By that logic their only what 15 virus on PC in the wild, i mean if any instace of a injection vector counts under the "the first" then there are only x virus = injection vector, their's no such thing as multiple viru using the same vector, nope. All the same.
------------------------------
Coming soon to Lulu.com --Tokusatsu Heroes--
Five teenagers, one alien ghost, a robot, and the fate of the world.
Paul_Lilly
November 23, 2009 at 3:08pm
You're right, the exploit itself is not new (well, it's kind of new, in that it was recently discovered), but the worm (or "application") is the first malicious use of the exploit. I see what you're saying, but the title is still correct regardless if jailbroken iPhone users do their research or not. And on that latter point, we kind of cover that in the first paragraph.
-Paul Lilly
lancethepants
November 23, 2009 at 11:43am
Try reading the article and looking at their posted links
http://www.sophos.com/blogs/chetw/g/2009/11/21/malicious-iphone-worm-loose/
GFC
November 23, 2009 at 9:30am
As if lithuania wasnt known for shit like that - they still manage to embarrass me in front of the internet. Yea, way to go guys.. <.<
And em.. if you can - don't start blockin' all the LT Ips, yea.. i really <3 maximum pc x}
LVmonkey
November 23, 2009 at 10:10am
"The recommended fix is to restore jailbroken iPhones to the current Apple-supplied firmware. "
Or, as the author of the worm has suggested...change the default password of your ssh to something other than the default. ---which is to say there may have been a reason behind you jailbreaking it in the first place and the worm was made specifically to show people that they need to get on that default password for ssh thing.
Connect with MaximumPC
Featured Content
We introduce Intel's latest class of tablet killers and review 4 of the first Ultra...
Where have all the memorable videogame enemies gone?
This month's issue
Feature
11 Hardware Hacks
Feature
Overclock Your CPU
How-To
Supercharge Your Smartphone
Build It
A Powerful $830 Rig
Most Commented Articles
Latest Max PC Tweets
- maximumpc: Can RIM *ever* catch a break? Not today! App World numbers not as great as previously reported http://t.co/3ERRhr3119 hours 49 min ago
- maximumpc: Solid state shakeup: Intel 520 SSD vs OCZ Octane vs Patriot Pyro SE! http://t.co/lXDufI7w21 hours 5 min ago
- maximumpc: Woman Ordered to Decrypt Laptop Claims She "Forgot" Key http://t.co/C2TCp4Ml22 hours 1 sec ago
