By: Brian Prince
2009-11-09
The first known worm for Apple's iPhone is spreading on jail-broken
iPhones in Australia. The worm takes advantage of the default password
for SSH used by many jail-broken phones and places an image of 1980s pop
singer Rick Astley on the device.
The first known worm for the Apple iPhone is sweeping across Australia,
and it is taking advantage of default SSH passwords on jail-broken phones.
The attack vector is the same as the one exploited by a Dutch teenager
last week in a brief extortion attempt. This time around, the mind
behind the attack isn�t doing anything bad�unless you don�t like having
English pop singer Rick Astley as your wallpaper.
Once installed, the worm�known as ikee�tries to find other iPhones on
the mobile phone network that are vulnerable so it can propagate. On
each installation, the worm changes the lock background wallpaper to an
image of the 1980s singer with the message: �ikee is never going to give
you up.�
�Ashley Towns, the author of the worm, says he personally infected 100
jail-broken iPhones,� said Graham Cluley, senior technology consultant
at Sophos. �Those iPhones would then have tried to infect other
jail-broken iPhones, and so on, and so on.�
The jail-broken iPhones impacted by the worm are running an SSH with the
iPhone's default password. Last week, news reports surfaced that a Dutch
attacker used the same situation in combination with port scanning and
OS fingerprinting to find iPhones in T-Mobile�s 3G IP range to install
backdoors on the phones and scare users into paying �5 (US$7.43) for
instructions on how to thwart the attack.
Security vendor F-Secure reported that the latest attack scans a handful
of IP ranges, mostly in Australia. As of Sunday, the company had no
confirmed reports of the worm outside of Australia. The company noted
that there are four variants of the worm, and that Towns has provided
full source code for the malware. That means more variants could be
forthcoming, and both Cluley and F-Secure agreed the next payload could
be worse.
�We can only hold our breath and hope it doesn't happen,� Cluley said.
�Unfortunately the genie is out of the bottle as the worm's code has
been published on the Web. It would be relatively trivial for malicious
hackers to adapt the code to make the worm more financially motivated
rather than mischievous.�
> The first known worm for Apple's iPhone is spreading on jail-broken
> iPhones in Australia. The worm takes advantage of the default password
> for SSH used by many jail-broken phones and places an image of 1980s pop
> singer Rick Astley on the device.
Superb.
--
Adrian C
> The first known worm for Apple's iPhone is spreading on jail-broken
> iPhones in Australia.
Moral: Don't jail-break your iPhone :-).
--
Per Erik R�nne
http://www.RQNNE.dk
Errare humanum est, sed in errore perseverare turpe
> To get infected you must
> 1. jailbreak the phone
> 2. use SSH
more accurately, install sshd and enable incoming connections.
you can use ssh (outbound) and not be at risk, and you don't even need
to jailbreak to do that.
> 3. not change the password
> > The first known worm for Apple's iPhone is spreading on jail-broken
> > iPhones in Australia.
>
> Moral: Don't jail-break your iPhone :-).
it's not jailbreaking that's the issue, it's ssh that is left open with
a known password. either don't install ssh or change the password.
> �We can only hold our breath and hope it doesn't happen,� Cluley said.
> �Unfortunately the genie is out of the bottle as the worm's code has
> been published on the Web. It would be relatively trivial for malicious
> hackers to adapt the code to make the worm more financially motivated
> rather than mischievous.�
What could possibly be worse than putting a picture of Rick Astley on
your phone, they haven't got a pic of Larry have they?!!
Mike
Nope, but there's another worm called "Larry" that does turn all your
incoming messages into gibberish, lies, misinformation and nonsense. ;-)
So one of these won't work then ...
http://www.youtube.com/watch?v=YzaNXBXuFPA
(sorry)
--
Adrian C
I think that's infected the network at work.
Mike
Partly, jailbreaking /is/ the issue - but of course it is making things
worse when ssh has been installed without changing the password ...
> > > > The first known worm for Apple's iPhone is spreading on jail-broken
> > > > iPhones in Australia.
> > >
> > > Moral: Don't jail-break your iPhone :-).
> >
> > it's not jailbreaking that's the issue, it's ssh that is left open with
> > a known password. either don't install ssh or change the password.
>
> Partly, jailbreaking /is/ the issue - but of course it is making things
> worse when ssh has been installed without changing the password ...
jailbreaking is *not* the issue. a jailbroken phone is immune to this
exploit if sshd is not installed, or if it is installed, by changing
the default password. the problem is *ssh*.
Of course the problem is ssh and not jailbreaking.
Apple fanboys will pick any excuse to denounce jailbreaking, since
jailbreaking defies Apple's walled garden and defying Apple is the Worst
Sin for fanboys.
-- Mark --
http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.
It puts a big picture of a Nokia N900 on your screen....hee hee...(c;]
--
Larry
> In article <alpine.OSX.2.00.0...@hsinghsing.panda.com>,
> Mark Crispin <m...@panda.com> wrote:
>
> > > jailbreaking is *not* the issue. a jailbroken phone is immune to this
> > > exploit if sshd is not installed, or if it is installed, by changing
> > > the default password. the problem is *ssh*.
> >
> > Of course the problem is ssh and not jailbreaking.
>
> Of course, without jailbreaking, you can't install sshd.
Exactly.
> Michelle Steiner <mich...@michelle.org> wrote:
>
> > In article <alpine.OSX.2.00.0...@hsinghsing.panda.com>,
> > Mark Crispin <m...@panda.com> wrote:
> >
> > > > jailbreaking is *not* the issue. a jailbroken phone is immune to this
> > > > exploit if sshd is not installed, or if it is installed, by changing
> > > > the default password. the problem is *ssh*.
> > >
> > > Of course the problem is ssh and not jailbreaking.
> >
> > Of course, without jailbreaking, you can't install sshd.
>
> Exactly.
BTW, jailbreaking leads up to other problems. Just look at this:
I quote:
=
Please note: Jailbreak iPhones are not equipped to process in-app
purchases.
=
> Please note: Jailbreak iPhones are not equipped to process in-app
> purchases.
that's false.
Then tell the Weather Pro developers.
> Exactly.
What is your objection to jailbreaking exactly? This worm won't hit the
knowledgeable, so what's the problem?
--
Suddenly he realized that he was alone
with a giant halfwit on a dark deserted street.
-- Chester Himes
The CLUELESS, obviously.
> In article <1j902oa.12drpa4yt5v58N%p...@RQNNE.invalid>,
> p...@RQNNE.invalid (Per R�nne) wrote:
>
> > Exactly.
>
> What is your objection to jailbreaking exactly? This worm won't hit the
> knowledgeable, so what's the problem?
I simply don't want to risk my own iPhone jailbreaking it. Just to be
able to run software I might write myself.
The problem which needs addressing is why is the phone in jail to begin
with
seems like a shit policy forcing the breaks
Now, now. Unkind to point out the emperor's lack of clothes...
I can only agree if what you mean is that Apple has been too restrictive
when coming to access to APIs in their public SDK.
Some object that iPhone OS won't allow third party applications to run
in the background [Apple's own built-in applications already do].
In particular I object to the lack of APIs to the internal calendar and
alarm database - which would give access to MobileMe and Exchange Server
and to setting up alarms from Personal Information Managers like Pocket
Informant and DateBk6. The built-in iCal calendar is beneath contempt,
Pocket Informant can't run as good as it could - and DateBk6 won't be
available on the platform before Apple changes its policy.
But of course the firms behind these PIMs will not use jailbreaking to
get access to what they need. The access has to be through the proper
iPhone SDK APIs. From Apple.
>
> In particular I object to the lack of APIs to the internal calendar and
> alarm database - which would give access to MobileMe and Exchange Server
> and to setting up alarms from Personal Information Managers like Pocket
> Informant and DateBk6. The built-in iCal calendar is beneath contempt,
> Pocket Informant can't run as good as it could - and DateBk6 won't be
> available on the platform before Apple changes its policy.
>
> But of course the firms behind these PIMs will not use jailbreaking to
> get access to what they need. The access has to be through the proper
> iPhone SDK APIs. From Apple.
I am told several other o/s run things well with less apple
interference .. ?
>Some object that iPhone OS won't allow third party applications to run
>in the background [Apple's own built-in applications already do].
>
>In particular I object to the lack of APIs to the internal calendar and
>alarm database - which would give access to MobileMe and Exchange Server
>and to setting up alarms from Personal Information Managers like Pocket
>Informant and DateBk6. The built-in iCal calendar is beneath contempt,
As an outside observer, I'm surprised to learn that the iCal app is
beneath contempt. I (wrongly) assumed that the coveted lower case
leading 'i' in its name meant it was top notch.
> Per R�nne wrote:
For a Mac user, synchronization is essential. I used to use a Palm Treo
- but Palm dropped Mac support.
Certainly not. And even though the iCal on Mac is much better than the
iCal on the iPhone, it too isn't worth much. It doesn't even support ISO
week numbers or proper tasks.
I've now turned to BusyCal which seem to evolve.
> BTW, jailbreaking leads up to other problems. Just look at this:
>
> <http://www.weatherpro.eu/>
>
> I quote:
>
> =
> Please note: Jailbreak iPhones are not equipped to process in-app
> purchases.
> =
From what you've linked, it sounds like in-app purchases in their
particular app are problematic anyway. A quick Google search didn't find
any references to in-app purchases being a common problem for jailbroken
phones.
Jailbreaking probably causes some problems, but I'd suspect most stem
from the particular "unapproved" apps jailbreakers choose to run.
Changing the ringtone to a Rick Astley song. Imagine the
embarrassment when your phone rings.
Peter.
Perhaps. I use the application but have no intention of purchasing extra
facilities to it.
You win!
Mike
>Warren Oates <warren...@gmail.com> wrote:
>
>> In article <1j902oa.12drpa4yt5v58N%p...@RQNNE.invalid>,
>> p...@RQNNE.invalid (Per R�nne) wrote:
>>
>> > Exactly.
>>
>> What is your objection to jailbreaking exactly? This worm won't hit the
>> knowledgeable, so what's the problem?
>
>I simply don't want to risk my own iPhone jailbreaking it. Just to be
>able to run software I might write myself.
You don't need to jailbreak to write your own apps, if you stay more or
less within the lines. Think Different, but only like we tell you.
Oh, the kind of software I think of, a large Danish-English,
English-Danish dictionary, would never be accepted by the AppStore as
the data belongs to the publishing house Gyldendal - unfortunately this
house doesn't seem to be interested in getting out dictionaries to
iPhone users ;-(.
Earlier this year, however, they /did/ publish proper dictionaries
between Danish and English, German, French and Spanish for MacOS X. With
110.000-150.000 words each. A competing company has, though, published
dictionaries for the iPhone but only with 35.000 words - making them
almost valueless.
At present I'm using Audio Shorter Oxford English Dictionary [600.000
entries] and Oxford's dictionaries to and from other languages [160.000
entries] on my iPhone. And Gyldendal's Dictionaries + Oxford English
Dictionary [all 23 volumes] on my Mac.
>DevilsPGD <Death...@crazyhat.net> wrote:
>
>> In message <1j90tbr.13346ty1hwjy01N%p...@RQNNE.invalid> p...@RQNNE.invalid
>> (Per R�nne) was claimed to have wrote:
>>
>> >Warren Oates <warren...@gmail.com> wrote:
>> >
>> >> In article <1j902oa.12drpa4yt5v58N%p...@RQNNE.invalid>,
>> >> p...@RQNNE.invalid (Per R�nne) wrote:
>> >>
>> >> > Exactly.
>> >>
>> >> What is your objection to jailbreaking exactly? This worm won't hit the
>> >> knowledgeable, so what's the problem?
>> >
>> >I simply don't want to risk my own iPhone jailbreaking it. Just to be
>> >able to run software I might write myself.
>>
>> You don't need to jailbreak to write your own apps, if you stay more or
>> less within the lines. Think Different, but only like we tell you.
>
>Oh, the kind of software I think of, a large Danish-English,
>English-Danish dictionary, would never be accepted by the AppStore as
>the data belongs to the publishing house Gyldendal - unfortunately this
>house doesn't seem to be interested in getting out dictionaries to
>iPhone users ;-(.
You can still write your own app and run it locally, without AppStore
approval...
It could be worse ... you could end up with Britney Spears ring tones. ;-)
Just another one-hit-wonder "created" by the music industry because he
looked good to females, rather than someone who actually has any talent.
As far as I know only if you're a registered and /paying/ developer.
> Michelle Steiner <mich...@michelle.org> wrote:
>> Of course, without jailbreaking, you can't install sshd.
>
> Exactly.
By that logic, buying an iphone is the problem.
--
<http://ale.cx/> (AIM:troffasky) (UnSoEs...@ale.cx)
21:34:33 up 25 days, 23:09, 4 users, load average: 0.13, 0.22, 0.17
"Stupid is a condition. Ignorance is a choice" -- Wiley Miller
It might have a melt down ....
Mike
>DevilsPGD <Death...@crazyhat.net> wrote:
>
>> In message <1j930pz.udvf161ckily5N%p...@RQNNE.invalid> p...@RQNNE.invalid
>> (Per R�nne) was claimed to have wrote:
>
>> >Oh, the kind of software I think of, a large Danish-English,
>> >English-Danish dictionary, would never be accepted by the AppStore as
>> >the data belongs to the publishing house Gyldendal - unfortunately this
>> >house doesn't seem to be interested in getting out dictionaries to
>> >iPhone users ;-(.
>>
>> You can still write your own app and run it locally, without AppStore
>> approval...
>
>As far as I know only if you're a registered and /paying/ developer.
Correct. Only $100 stands between you and becoming a paying developer.
>
> You don't need to jailbreak to write your own apps, if you stay more or
> less within the lines. Think Different, but only like we tell you.
As a child did you grab the crayon and scribble all over the page, or did
you stay in the lines so it didn't get all F'd up?
> In message <1j93656.1vi2j6wv359f8N%p...@RQNNE.invalid> p...@RQNNE.invalid
> (Per R�nne) was claimed to have wrote:
>
> >DevilsPGD <Death...@crazyhat.net> wrote:
> >
> >> In message <1j930pz.udvf161ckily5N%p...@RQNNE.invalid> p...@RQNNE.invalid
> >> (Per R�nne) was claimed to have wrote:
> >
> >> >Oh, the kind of software I think of, a large Danish-English,
> >> >English-Danish dictionary, would never be accepted by the AppStore as
> >> >the data belongs to the publishing house Gyldendal - unfortunately this
> >> >house doesn't seem to be interested in getting out dictionaries to
> >> >iPhone users ;-(.
> >>
> >> You can still write your own app and run it locally, without AppStore
> >> approval...
> >
> >As far as I know only if you're a registered and /paying/ developer.
>
> Correct. Only $100 stands between you and becoming a paying developer.
And since I'm a computer science major I should be able to develop such
an application. The matter is whether I find it worth the efforts taking
into account it would be illegal - and since the owner might decide to
develop the proper dictionaries with newer data.
I don't consider it worth the effort.
--
Per Erik R�nne, MSc
Frederikssundsvej 308B, 3. tv.
DK-2700 Br�nsh�j, Denmark
Telephone + fax +45 38 89 00 16, mobile +45 28 23 09 92
http://www.RQNNE.dk
> Meanwhile, at the alt.internet.wireless Job Justification Hearings, Per R�nne
> chose the tried and tested strategy of:
>
> > Michelle Steiner <mich...@michelle.org> wrote:
>
> >> Of course, without jailbreaking, you can't install sshd.
> >
> > Exactly.
>
> By that logic, buying an iphone is the problem.
To me, my iPhone is mainly a PDA that syncs properly with my Mac. And
which functions as a cell phone too - one less gadget to go around with
in the trousers.
On the other hand, if you've done all the work, the owner MIGHT decide to
buy the application off you (it would be cheaper than doing the work
themselves). :-)
> "Per R�nne" <p...@RQNNE.invalid> wrote in message
> news:1j93t1d.zheweu15dunyhN%p...@RQNNE.invalid...
> > And since I'm a computer science major I should be able to develop such
> > an application. The matter is whether I find it worth the efforts taking
> > into account it would be illegal - and since the owner might decide to
> > develop the proper dictionaries with newer data.
> >
> > I don't consider it worth the effort.
>
> On the other hand, if you've done all the work, the owner MIGHT decide to
> buy the application off you (it would be cheaper than doing the work
> themselves). :-)
I don't think so. Gyldendal is the oldest and most dominant Danish
publishing house [founded 1770 - and with a market share close to that
of a monopoly]. They make their own decisions and the data I have come
from an old version of the Danish-English and English-Danish
dictionaries for Classic Mac. In html-code - 15-20 years old.
I think the size of the dictionaries has increased hevealy since.
> As a child did you grab the crayon and scribble all over the page, or did
> you stay in the lines so it didn't get all F'd up?
I made my own lines, then drew within them. I've made a lot of money
through life doing that, too.
--
Suddenly he realized that he was alone
with a giant halfwit on a dark deserted street.
-- Chester Himes
You could make a generic dictionary app that can download and install
dictionary data, then it would do what you want and not be illegal and
be acceptable to the App Store.
Of course - with a proper description of how data should be structured
before import.
"Drew"?!? How quaint and old fashioned. Those of us with brains clicked on
the paint can icon, clicked on a colour, and then clicked in a blank
outlined space ... a few clicks later you click on Print and you're
finished. ;-)
I remember way back when dinosaurs roamed the earth buying a large A3+
cut-out model of an R2-D2-style droid which you had to colour in ... my
younger brother "helped" and ruined it by colouring outside the lines, and
there were none left to buy another one. :-(
I started drawing on the page and then moved onto the desk, table,
chair, walls, floor, etc. Rigid artificial boundaries are not for me.
--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558
# http://802.11junk.com je...@cruzio.com
# http://www.LearnByDestroying.com AE6KS
Then your parents came a smacked you for being naughty ... which was meant
to teach you to respect the rules. Of course, in these days of "politicially
correct" garbage you aren't allowed to smack children for being naughty, and
hence so many people think they can simply do whatever they want. :-(
There's now absolutely no reason to make such an application.
Friday, Gyldendal released dictionaries between Danish and English,
German and French. With around 200,000 entries each. I'm just
downloading those to English and German, may main foreign languages.