iPhone worms (insert joke)
Ok it’s been a little while since I’ve written anything so here we go and be gentle all. I’m not sure if we do have much(if any) of an iPhone following but I wanted to address an issue that has been popping up lately with jailbroken devices. Worms that are starting to fly about, given mostly in our fellow European brethren’s countries.
The first came out back at the beginning of November when a Dutch hacker performed a little port scanning trickery and accessed through SSH some iPhones that still had their root passwords set to the default that Apple set. Now he backed off of his nefarious intentions and taught those a lesson that they will probably never forget.
A more recent example is once again across the pond. This one attacks the same as the first through SSH. The attack allows the hacker to remotely control the infected iPhone and put up a fake ING Direct login page. By doing this the hacker scrapes off the info that the user enters to collect banking info from the unassuming user. The hack is also capable of spreading over whatever WiFi network which the phone is connected.
Follow on after the break to see just how to lock your jailbroke iPhone down…
Now I’ve put this out in the ether many times now, and I still see people asking questions and new viruses popping up in many places so this is why I’m putting it up one last time on the best damn blog out there.
****How to change your root password ****
Assuming you have a Jailbroken iPhone
1. Install Open SSH via Cydia
2. Install Mobile Terminal via Cydia
3. Start Mobile Terminal and type "login root"
4. Enter default root password "alpine"
5. Enter "passwd" command hit return
6. Enter new password, confirm password.
7. Done, your phone is now safe.
Remember there are two passwords one for the mobile account and root account. You can change the mobile if you want also. if you want to do that just skip step 4 and continue with the rest. As you are already in the mobile account when you initially start Mobile Terminal.
See just how easy it is to protect yourself from these worms? And why it’s frustrates me so much to see so many that haven’t done it? And this also does not break Push notifications like some have stated, that is broken by hacktivation.(unlocking your iPhone for other carriers)
Any questions that you may have or if you just want to let me know how this works for you, it would be greatly appreciated.
Related Posts
About The Author
Using default root passwords is a load. It would be safer to set the root password to something random. If I was Apple (luckly, I’m not), I’d set the root password to the MD5 hash of the Mac address of the Wi-Fi unit. It’s definitely not fail proof, but it’s still much safer.
The only problem with that is when you need to use a password that is md5, triple des or any other of the more secure types. Try and enter that in when you need it. But I understand what you mean.