iBotnet.A : Another Malware for iPhone

iKee Worm, iPhone/Privacy.A and now iBotnet.A yet another malware for iPhone is identified. The first one was iKee, such malware changed wallpaper on iPhones. The second one iPhone/Privacy.A aims to  harvest personal data from iPhones. This new malware, that Intego calls iBotnet.A, is by far the most sophisticated iPhone malware yet. It is not only a worm, capable of spreading across a network, but also hijacks iPhones or iPod touches for use in a botnet. A botnet is a series of infected nodes that work together to perform a nefarious task such as overloading a website with requests, essentially shutting it down to other users (denial of service) or sending unsolicited emails (spam).

Cases of spread of these worms are becoming more frequent and are not limited to the Netherlands but also in Portugal, Hungary and Australia.iBotnet.A is the name that was given by Intego because the worm is able to enter iPhone, change the standard SSH password (alpine) and ensures total control, since you may no longer be changed.This worm connects to a server unfortunate iPhone in Lithuania which sends SMS and other data stolen also always via this link, can download additional malicious software that turns the device into a botnet that can be controlled from a far .The pirates will then use it to send spam or spread malware to steal passwords for all secure sites to which the user accesses (such as banks, PayPal, etc.).

We need to clarify that all these worms/hacks/malware can infect only those jailbroken iPhone whose SSH was turned on with the default root:alpine configuration. That doesn’t means all jailbroken iPhones are in the range of attack. A little workaround to change the default password can make safe your iPhone as normal. We published a guide to change your default password of SSH, if you missed then check Secure Your Jailbroken iPhone and Change your Default Password.

Source ihackintosh

Australian admits creating first iPhone virus / iPhone/Privacy.A Virus Hits Jailbroken iPhone

A 21-year-old Australian man has admitted creating what is thought to be the first virus to infect Apple iPhones.

The virus, which can spread from phone to phone, changes the iPhone's wallpaper to a photograph of 1980s singer Rick Astley - best known for his hit Never Gonna Give You Up.

The wallpaper features the words "Ikee is never gonna give you up".

However, the virus can only infect phones which have been jailbroken by their owners. Jailbreaking allows the owners to run non-Apple approved applications on their phones.

Ashley Towns, a 21-year-old TAFE student who lives with his family in Wollongong, south of Sydney, told ABC News Online he created the virus to raise the issue of security.

"When people jailbreak their phone, it allows them to install a service on their phone called SSH," he said.

"Generally you should always change your password after setting up on the iPhone as all iPhones use the same password.

"This virus pretty much exploits people's laziness to change their password."

He says his efforts prove that anyone could easily hack into an iPhone.

"I think to raise awareness for one, somebody with more malicious intent could have done anything - read your SMSs, go through your emails, view your contacts, photos - anything," he said.

Mr Towns says he is unaware if he is breaking any law by starting the virus.

"I've been informed that I may have broken some, but not being a lawyer I do not know," he said.

"The virus itself is not malicious and is not out to hurt people. It's just poking fun and hoping waking people up a little."

He says it is the first virus of its kind.

"Yes, especially the first that spreads from phone to phone," he said.

Mr Towns says he does not know how many people the virus could affect.

"Due to the nature of it, it's kind of hard to tell, I know my phone hit about 100 alone but from there I have no idea," he said.

But he says apart from changing the wallpaper on a user's phone, the virus is not harmful and quite easy to get rid of.

"[It does] nothing malicious at all, it basically only changes their wallpaper to Rick Astley," he said.

He says it takes a couple of minutes to remove by simply changing the phone's password and deleting a few files from the phone.

Mr Towns says he can prove that he created the virus by postings on Twitter made by him under the same name that was in the source code.

He says the original source code also had his email in it, but Google code removed it.

Source: abc.net.au

iPhone/Privacy.A Virus Hits Jailbroken iPhone

November has proved tough for jailbroken iPhone users as they twice came under attack by hackers. First one which we did warned you about was when a Dutch hacker tried to access jailbroken iPhones through SSH in his native country Netherlands. He was successful in sending totally off guarded users a message that read, "Your iPhone’s been hacked because it’s really insecure! Please visit doiop.com/iHacked and secure your iPhone right now! Right now, I can access all your files.". The second development was an attempt by an Australian who successfully injected a worm called “ikee” into jailbroken iPhones whose users forgot to change their root password for SSH. Victims of ikee virus were astonished to find their home screen background automatically changed to that of Rick Astley. ikee virus spread like a chain reaction from iPhones on one cellular network, to iPhones on other.

In the first case, the Dutch hacker regretted his action and reverted everything back, whereas in the second case, it was simply an experiment by the young Aussie whose worm ikee did not do any harm to the victims iPhone. All these attacks had one thing in common, they were targeted towards jailbroken iPhone users who were using the default root:alpine username/password combination. In our earlier post we had already recommended you all on how to secure and how to protect your iPhone against such vulnerabilities.

Previous attacks did not do much harm but this new one which is identified as iPhone/Privacy.A virus carries alot more risk. As reported by MobileCrunch, the computer security firm Intego has identified the truly malicious malware named iPhone/Privacy.A that targets jailbroken iPhones with default user/password combo and is probably the first harmful one of its kind. The virus in question gives a hacker complete access on the victim’s iPhone. The hacker can access and copy any user data from the jailbroken device, including emails, contacts, calendars, photos, SMSs, videos, in fact any data the hacker wants.

Intego explains iPhone/Privacy.A Virus in more detail as follows:

Hackers using this tool will install it on a computer – Mac, PC, Unix or Linux – then let it work. It scans the network accessible to it, and when it finds a jailbroken iPhone, breaks into it, then steals data and records it.

This hacker tool could easily be installed, for example, on a computer on display in a retail store, which could then scan all iPhones that pass within the reach of its network. Or, a hacker could sit in an Internet café and let his computer scan all iPhones that come within the range of the wifi network in search of data. Hackers could even install this tool on their own iPhones, and use it to scan for jailbroken phones as they go about their daily business.

It is highly recommended that you change your iPhone’s default SSH mobile and root password now. A complete step by step guide on how to change your jailbroken iPhone’s SSH password can be found here.

You can follow us on twitter to keep yourself updated on all the latest jailbreaking and unlocking releases.

Source: redmondpie

Protect iPhone 3GS Against ikee Virus Attack

In continuation from our last post, here is yet another development which took place in the last few days when some jailbroken iPhone users found their home screen background a little different than it was last seen by them. If your jailbroken iPhone has changed its background automatically to that of Rick Astley (some 80’s singer) with the words "ikee is never going to give you up", then you are most likely a victim of ikee virus which infects iPhone’s via SSH. The virus in question has originated from Australia by a hacker named Ikee and it is now quickly spreading to other parts of the world. If you have been affected, luckily there is no harm done as this virus was more of an experiment than anything else.

ikee is basically a worm which infects an iPhone via SSH. Once an iPhone has been infected by ikee, It automatically starts searching for other iPhone’s on the cellular network that use the root:alpine username/password combination. Once it finds another vulnerable iPhone, it installs itself and begins the process again and this goes on like a nuclear chain reaction. ikee virus will disable SSH access on your iPhone and will change the background image to that of “Rick Astley” as can be seen in the screenshot above.

Here is an excerpt from the recently held interview with the hacker Ikee over IRC:

First I was curious to how far something like this would actually spread, I think what most people were unaware of is the fact it is a worm and every phone that got infected with it was spreading it (I initially only infected 3 phones when I woke up I checked Google and found out a fair few people were hit with it). Secondly I was quite amazed by the number of people who didn’t RTFM and change their default passwords. I also didn’t think that many people would have not changed their passwords. I was expecting to see maybe 10~ or so people, at first I was not even going to add the replicate/worm code but it was a learning experience and I got a tad carried away. I heard a few stories about it, that would have been sheer luck, the code itself is set to firstly scan the 3G IP range the phone is on, then Optus/Vodafone/Telstra’s IP Ranges (I think the reason Optus got hit so hard is because the other 2 are NAT’d) then a random 20 IP ranges. I’m guessing a few phones hit a range that another vulnerable phone was on. I don’t think it was an Optus fault (Being an Optus user I quite like the fact I can access my iPhone services from the outside world), I think it was mainly the fault of people being too lazy to change their passwords (It only takes a couple of seconds guys) and I hope this taught a few people that.

To protect your jailbroken iPhone or iPod touch from ikee virus attack or any other similar attacks in the future, you must change your default SSH password now. Follow our detailed step by step guide posted here which explains how to change your SSH password. Remember to secure your iPhone is yours and only your responsibility, else there are many hackers out there with brilliant minds who can easily infringe on your sovereignty.

You can follow us on twitter to keep yourself updated on all the latest iPhone jailbreaking and unlocking releases.

Source: redmondpie, tuaw