Morale: Lad være med at jailbreake din iPhone!
------- Begin Forwarded Message -------
Subject: iPhone Worm Hits Australia
From: News <News@Group.Name>
Newsgroups: alt.cellular.attws
alt.cellular.cingular
alt.internet.wireless
misc.phone.mobile.iphone
Date: Tue, 10 Nov 2009 12:30:06 -0500
First iPhone Worm Hits Australia
By: Brian Prince
2009-11-09
The first known worm for Apple's iPhone is spreading on jail-broken
iPhones in Australia. The worm takes advantage of the default password
for SSH used by many jail-broken phones and places an image of 1980s pop
singer Rick Astley on the device.
The first known worm for the Apple iPhone is sweeping across Australia,
and it is taking advantage of default SSH passwords on jail-broken phones.
The attack vector is the same as the one exploited by a Dutch teenager
last week in a brief extortion attempt. This time around, the mind
behind the attack isn't doing anything bad—unless you don't like having
English pop singer Rick Astley as your wallpaper.
Once installed, the worm—known as ikee—tries to find other iPhones on
the mobile phone network that are vulnerable so it can propagate. On
each installation, the worm changes the lock background wallpaper to an
image of the 1980s singer with the message: 'ikee is never going to give
you up.'
"Ashley Towns, the author of the worm, says he personally infected 100
jail-broken iPhones," said Graham Cluley, senior technology consultant
at Sophos. "Those iPhones would then have tried to infect other
jail-broken iPhones, and so on, and so on."
The jail-broken iPhones impacted by the worm are running an SSH with the
iPhone's default password. Last week, news reports surfaced that a Dutch
attacker used the same situation in combination with port scanning and
OS fingerprinting to find iPhones in T-Mobile's 3G IP range to install
backdoors on the phones and scare users into paying €5 (US$7.43) for
instructions on how to thwart the attack.
Security vendor F-Secure reported that the latest attack scans a handful
of IP ranges, mostly in Australia. As of Sunday, the company had no
confirmed reports of the worm outside of Australia. The company noted
that there are four variants of the worm, and that Towns has provided
full source code for the malware. That means more variants could be
forthcoming, and both Cluley and F-Secure agreed the next payload could
be worse.
"We can only hold our breath and hope it doesn't happen," Cluley said.
"Unfortunately the genie is out of the bottle as the worm's code has
been published on the Web. It would be relatively trivial for malicious
hackers to adapt the code to make the worm more financially motivated
rather than mischievous."
-------- End Forwarded Message --------
--
Per Erik Rønne
http://www.RQNNE.dk
Errare humanum est, sed in errore perseverare turpe