First iPhone Worm Discovered, Rickrolls Jailbroken Phones 215
Unexpof writes "Users of jailbroken iPhones in Australia are reporting that their wallpapers have been changed by a worm to an image of '80s pop icon Rick Astley. This is the first time a worm has been reported in the wild for the Apple iPhone. According to a report by Sophos, the worm, which exploits users who have installed SSH and not changed the default password, hunts for other vulnerable iPhones and infects them. Users are advised to properly secure their jailbroken iPhones with a non-default password, and Sophos says the worm is not harmless, despite its graffiti-like payload: 'Accessing someone else's computing device and changing their data without permission is an offense in many countries — and just as with graffiti there is a cost involved in cleaning-up affected iPhones. ... Other inquisitive hackers may also be tempted to experiment once they read about the world's first iPhone worm. Furthermore, a more malicious hacker could take the code written by ikee and adapt it to have a more sinister payload.'"
Similar case (Score:5, Informative)
Ars technica reported a similar case in the Netherlands about a week ago. A teenage "hacker" replaced the wallpaper with one showing an alert that told the user to give him 5 euros for instructions to remove the "virus". Full article [arstechnica.com]
This story seems familiar (Score:3, Informative)
Oh right. [arstechnica.com] Probably someone saw that story too and decided to have a little fun with the same gaping security hole too.
Re:What does this mean exactly? how to fix? (Score:3, Informative)
Re:What does this mean exactly? how to fix? (Score:5, Informative)
Go to Cydia, manage tab, packages, and see if OpenSSH is on the list of installed packages.
If it is, download and install a package from Cydia called MobileTerminal.
Start MobileTerminal, type in "su", then type in the default password "alpine", then type in "passwd", and set a new password (don't use " quote marks " in any of these commands)
Re:Narrow Band detector (Score:5, Informative)
also this article fails to mention that the worm disables ssh after infecting the device.. therefore kinda cleaning up the problem ..
Re:arguably Apple share the blame (Score:5, Informative)
The only rivals that are completely unlocked are Palm OS (which is a joke,) Windows Mobile, and Maemo.
Android and WebOS do at least allow you to install unsigned apps, but you don't get root access without a jailbreak, and BlackBerry and Symbian both require signed apps and don't even give root to most signed apps. Useful for things like tethering (although not required.)
Re:arguably Apple share the blame (Score:3, Informative)
I did an interview with ikee-as is seen on my blog (Score:4, Informative)
Re:DEFAULT PASSWORD? (Score:3, Informative)
User: root
Password: alpine
Unless you reset it with passwd once you get in (something no guide underscores the importance of, and your typical "ooooh shiny" mass-market Apple consumer won't know), this is the default.
Having a default password is bad enough, but my question is: why does the celluar network in Australia permit direct device-to-device connections over the air?
Re:I did an interview with ikee-as is seen on my b (Score:1, Informative)
Just adding some background info to this drama, OzJD was in cahoots with ikee before this was released and they are both making the most of their 15 minutes of fame
don't click it! (Score:2, Informative)
Re:So... (Score:2, Informative)
Re:Summary: it affects ignorant fools (Score:3, Informative)
The root "account" on an iPhone is the same for all phones but is normally disabled. At least at some points in time, a jailbreak consisted of enabling SSH and that root account. SSHing into your phone using that account was the only way you could to anything else - it WAS the break.
Admittedly now, with more user friendly jailbreaks, SSH could ask you to change the password when you install it.
Re:What does this mean exactly? how to fix? (Score:4, Informative)
Re:Narrow Band detector (Score:3, Informative)
Not exactly. Jailbreaking an iPhone these days isn't what it used to be.
It doesn't even require the command line anymore.
Re:DEFAULT PASSWORD? (Score:4, Informative)
Actually, most of the jailbreaking guides did make a big deal of changing your password, back when installing SSH was a required part of the process. Apparently when you install SSH through Cydia today it also suggests you change the password. So the people who got hacked ignored a clear warning.
Once you connect your phone to the Internet, device to device connections are sort of the default. You have to purposely block incoming connections to prevent it.
Re:arguably Apple share the blame (Score:4, Informative)
WebOS - http://en.wikipedia.org/wiki/Web_OS [wikipedia.org]
big difference
Re:arguably Apple share the blame (Score:3, Informative)
Perhaps the makers of OpenSSH should change the first-run behavior to require the user enter a new password in order to prevent this issue?
No. OpenSSH is a tool for allowing remote access to a host. It is not a password manager, login manager, etc. Such functions are best separated from OpenSSH. Perhaps it would be best if the jailbreak utility prompt for a root password or generate and provide
the new SSH private key for the root account to allow for ssh key exchange logins and instruct the user to login via SSH to change the root password. Something like that.
A message for default passworded iPhone users... (Score:3, Informative)
If you are too stupid to change the default password on the SSH server running on your iPhone, you shouldn't have a jailbroken iPhone. You should leave the damn software alone so that Big Daddy Jobs can take care of security for you. Come back and see us jailbreakers when you get to wear your big boy panties.
Okay so I tried this... (Score:5, Informative)
My phone is Jailbroken but Cydia wasn't on it. I fired up Putty and nope, connection rejected. Tried to install SSH with Rock, it failed claiming that it didn't have Superuser privs. I fired up blacKra1n and installed Cydia. During the install Cydia appeared to install SSH but still no connection. I went in and reinstalled SSH, now I got a connection with the default password. But wait, at the bottom of the SSH install screen where it tells you how to use it they TELL YOU TO CHANGE THE PASSWORD! they also provide you a link to an article detailing HOW TO DO THAT. At this point I already had an SSH connection so I issued a passwd and changed it. TaDa, that hard to do - sheesh! I also installed an interesting little tool called Toggle SSH, gee guess what that does very well? Yup, blocks SSH connections at the press of a button - like a toggle ;-)
So, I had to jump through hoops to install the damned thing, then I received CLEAR instructions on how to change the default password, AND there's a simple to use FREE program out there that disables it. Obviously it might get installed as part of other things depending upon how you jailbroke but come on, they could not have made this too much easier to fix! If people are getting spanked by this well, perhaps they should have been a little more cognizant when they jailbroke? It's not hard to fix via any computer with SSH on it and you can even load a terminal program local to the phone to fix it....
Re:arguably Apple share the blame (Score:3, Informative)
Umm except I just did this with no problems? I logged out and back in with new password, no issues. This is on 3.12. what loop issue did you have and how do you go about triggering it? I will test...
Th Root Password (Score:5, Informative)
is alpine.