First-known iPhone worm 'Rickrolls' jailbroken Apple handsets

***AppleInsider*** · 11-09-2009, 07:48 AM

The iPhone's first worm -- a playful, wallpaper-changing prank that only affects jailbroken phones -- could be a sign of more dangerous things to come.

A hacker who identifies himself as "ikex" created the worm, which changes the user's wallpaper to a picture of 1980s pop star Rick Astley, who sang the 1987 hit "Never Gonna Give You Up." The software includes the message: "ikee is never gonna give you up."

The term jailbreaking refers to a hack that allows users to run software not approved by Apple on the iPhone. It can grant users the ability to install custom wallpapers and themes, enable tethering, or unlock the handset for use on a non-approved carrier.

The ikex worm is simply a prank known as "Rickrolling," an Internet bait-and-switch meme when users expect to see a video on a certain topic, only to find themselves watching Astley's cheesy 1987 music video. According to Forbes, the worm does nothing malicious.

"The world's first iPhone worm is also hardly a true criminal exploit," the report said. "Instead, it seems to be half warning, half prank. Ikee's author, who identifies himself or herself as 'ikex' in the worm's source code, also wrote in the code that "People are stupid, and this is to prove it so," adding that users should read their phones' manuals."

For now, the worm is said to be spreading among jailbroken iPhones in Australia. It affects only users who did not change their default SSH password, which allows file transfers between phones.

"It's not that hard, guys," ikex wrote in the source code. "But hey who cares its only your bank details at stake."

Mikko Hyppönen, researcher with F-Secure, discussed the worm on his company's Web site. It lets users know how to change their root password, and also warns that the software could become more dangerous.

"The creator of the worm has released full source code of the four existing variants of this worm," he said. "This means that there will quickly be more variants, and they might have nastier payload than just changing your wallpaper or might try password cracking to gain access to devices where the default password has been changed."

This summer, Apple quickly fixed a text messaging exploit that could have affected all iPhones. The exploit took advantage of the fact that SMS can send binary code to a phone. That code is automatically processed without user interaction, and can be compiled from multiple messages, allowing larger programs to be sent to a phone.

The exploit, discovered by security researcher Charlie Miller, exposed the iPhone completely, giving hackers access to the camera, dialer, messaging and Safari.

Miller also, back in 2007, discovered the iPhone's first security flaw. It allowed malicious Web sites to take advantage of flaws within the Safari Web browser.

[ View this article at AppleInsider.com ]

Quadra 610 · 11-09-2009, 07:59 AM

jailbreaking = making your own iPhone vulnerable, deliberately. It's self-hacking.

So where's the risk to the average user?

How is it really news that people who hack their iPhones (against Apple's recommendations) are getting into trouble because of it? Pehaps it's useful to warn them of the obvious . . .

doyourownthing · 11-09-2009, 08:08 AM

Quote:

Originally Posted by Quadra 610

jailbreaking = making your own iPhone vulnerable, deliberately. It's self-hacking.

So where's the risk to the average user?

How is it really news that people who hack their iPhones (against Apple's recommendations) are getting into trouble because of it? Pehaps it's useful to warn them of the obvious . . .

i know...when did ai become apple iphone hacker digest? jeez...

tawilson · 11-09-2009, 08:09 AM

Quote:

Originally Posted by Quadra 610

jailbreaking = making your own iPhone vulnerable, deliberately. It's self-hacking.

So where's the risk to the average user?

How is it really news that people who hack their iPhones (against Apple's recommendations) are getting into trouble because of it? Pehaps it's useful to warn them of the obvious . . .

This is most definitely the #1 reason not jailbreak the iPhone.

Followed closely by "stability issues".

CU10 · 11-09-2009, 08:10 AM

Quote:

Originally Posted by doyourownthing

i know...when did ai become apple iphone hacker digest? jeez...

Definitely, and they even forgot to post the video!

PG4G · 11-09-2009, 08:12 AM

Quote:

Originally Posted by Quadra 610

jailbreaking = making your own iPhone vulnerable, deliberately. It's self-hacking.

So where's the risk to the average user?

How is it really news that people who hack their iPhones (against Apple's recommendations) are getting into trouble because of it? Pehaps it's useful to warn them of the obvious . . .

Quadra, I agree with you, but I'd say that there is a large portion of the jailbreaking community who don't understand the nature of Jailbreaking. They see it as "unlocking what is rightfully theirs" and don't understand that to do so, you have to break many of the locks that Apple has put in there for good reason.

I have many friends who ask me about jailbreaking and describe it as the best thing ever. I, as a developer, explain why the locks are there, and then it dawns on them that their phone is also perhaps the most invasive device they have, can compromise your security, and could become just as vulnerable to viruses as Windows if the locks didn't exist.

There seems to be a good portion of current users who like to unlock their devices because its "cool" and "puts you in control" but fail to grasp what those hacks also allow in.

geekdad · 11-09-2009, 08:15 AM

Quote:

Originally Posted by AppleInsider

The iPhone's first worm -- a playful, wallpaper-changing prank that only affects jailbroken phones -- could be a sign of more dangerous things to come.

A hacker who identifies himself as "ikex" created the worm, which changes the user's wallpaper to a picture of 1980s pop star Rick Astley, who sang the 1987 hit "Never Gonna Give You Up." The software includes the message: "ikee is never gonna give you up."

The term jailbreaking refers to a hack that allows users to run software not approved by Apple on the iPhone. It can grant users the ability to install custom wallpapers and themes, enable tethering, or unlock the handset for use on a non-approved carrier.

The ikex worm is simply a prank known as "Rickrolling," an Internet bait-and-switch meme when users expect to see a video on a certain topic, only to find themselves watching Astley's cheesy 1987 music video. According to Forbes, the worm does nothing malicious.

"The world's first iPhone worm is also hardly a true criminal exploit," the report said. "Instead, it seems to be half warning, half prank. Ikee's author, who identifies himself or herself as 'ikex' in the worm's source code, also wrote in the code that "People are stupid, and this is to prove it so," adding that users should read their phones' manuals."

For now, the worm is said to be spreading among jailbroken iPhones in Australia. It affects only users who did not change their default SSH password, which allows file transfers between phones.

"It's not that hard, guys," ikex wrote in the source code. "But hey who cares its only your bank details at stake."

Mikko Hyppönen, researcher with F-Secure, discussed the worm on his company's Web site. It lets users know how to change their root password, and also warns that the software could become more dangerous.

"The creator of the worm has released full source code of the four existing variants of this worm," he said. "This means that there will quickly be more variants, and they might have nastier payload than just changing your wallpaper or might try password cracking to gain access to devices where the default password has been changed."

This summer, Apple quickly fixed a text messaging exploit that could have affected all iPhones. The exploit took advantage of the fact that SMS can send binary code to a phone. That code is automatically processed without user interaction, and can be compiled from multiple messages, allowing larger programs to be sent to a phone.

The exploit, discovered by security researcher Charlie Miller, exposed the iPhone completely, giving hackers access to the camera, dialer, messaging and Safari.

Miller also, back in 2007, discovered the iPhone's first security flaw. It allowed malicious Web sites to take advantage of flaws within the Safari Web browser.

[ View this article at AppleInsider.com ]

This is the same Charlie Miller that compromised the Mac in 2008 Pwn 2 Own in 2 minutes.....
Then did it again in Pwn 2 Own 2009 with the same Safari exploit but this time it took him 10 seconds.......
If you JB your iphone it will put it at risk along with giving it some additional features.
I guess if you are going to JB then change the default password on your iphone!!!

geekdad · 11-09-2009, 08:19 AM

Quote:

Originally Posted by PG4G

Quadra, I agree with you, but I'd say that there is a large portion of the jailbreaking community who don't understand the nature of Jailbreaking. They see it as "unlocking what is rightfully theirs" and don't understand that to do so, you have to break many of the locks that Apple has put in there for good reason.

I have many friends who ask me about jailbreaking and describe it as the best thing ever. I, as a developer, explain why the locks are there, and then it dawns on them that their phone is also perhaps the most invasive device they have, can compromise your security, and could become just as vulnerable to viruses as Windows if the locks didn't exist.

There seems to be a good portion of current users who like to unlock their devices because its "cool" and "puts you in control" but fail to grasp what those hacks also allow in.

I agree with you that most people that JB their phones do it because they think it will make them "cool".
But they have no idea what they are doing.......
It does open the phone up to a different set of vulnerabilities!

Jon T · 11-09-2009, 08:27 AM

How many times in the press will they fail to mention the 'jailbroken' part, or downplay it completely..?

Here we have the difference between Android ie Windows, and iPhone ie Mac....

ivan.rnn01 · 11-09-2009, 08:27 AM

There's something, which I just fail to understand. It's explained thousands of times and crystal clear to everyone, that being a regular legal owner of locked iPhone guarantees the smooth and issueless function of the device and decent assistance at any moment. App Store has 100 times richer collection of applications, than any illegal stores do. And people jailbreak "to be cool"... Stupid, no?

OnePotato · 11-09-2009, 08:28 AM

Quote:

Originally Posted by AppleInsider

Only to find themselves watching Astley's cheesy 1987 music video.

What's with all the hating on Rick Astley I've been seeing in various blogs. Rick is da bomb!

Quadra 610 · 11-09-2009, 08:29 AM

Quote:

Originally Posted by geekdad

This is the same Charlie Miller that compromised the Mac in 2008 Pwn 2 Own in 2 minutes.....
Then did it again in Pwn 2 Own 2009 with the same Safari exploit but this time it took him 10 seconds.......

What does this have to do with a jailbroken iPhone (other than it's a Charlie Miller production)?

Hacking with physical contact of the computer is data mining.

At pwn to own, the first day was to hack the Mac remotely. Not one person could do it. Nobody. No remote access, no viruses, nothing. Nobody can hack Macs remotely. To win the hacker needed local access to the machine. For his hack to work, it required somebody manually navigating to a site with malicious content.

For this hack to work in the real world, you would need to physically click a link to the malicious site somehow (in an email maybe, or a link via IM or whatever). Social Engineering. It relies on the ignorance of the computer user to do the hacker's job for him, because he can't do it himself.

Can your Mac get hacked remotely? No.

Will the hacker drive to your house and personally point your web browser to his site to infect your Mac? Not likely.

Make of that what you will.

Quadra 610 · 11-09-2009, 08:31 AM

Quote:

Originally Posted by ivan.rnn01

There's something, which I just fail to understand. It's explained thousands of times and crystal clear to everyone, that being a regular legal owner of locked iPhone guarantees the smooth and issueless function of the device and decent assistance at any moment. App Store has 100 times richer collection of applications, than any illegal stores do. And people jailbreak "to be cool"... Stupid, no?

Agreed.

It's the techie contingent doing most of it.

womble2k2 · 11-09-2009, 08:37 AM

I think in the early days of iPhone, Jailbreaking was done more to get Apps on the phone as the App Store did not exist at that time, but with 100,000 Apps on the App Store, I cannot see a reason for it.

It is like saying, I've bought a Mac as they don't get virus's, install Windows on the Mac but without virus software (as Mac's don't get virus's) and then complain if your windows installation becomes infected. Macs do get virus's if they are not running the OS that is designed to run on them, with all of the security measures Apple designs.

Jailbreaking is like putting your door key on a string behind your letterbox. People can reach in, grab the string and then the key and open the door to your house!

ivan.rnn01 · 11-09-2009, 08:39 AM

Quote:

Originally Posted by Quadra 610

It's the techie contingent doing most of it.

Sure, it's "techies". Those of the kind "I just jailbroke and killed my iPhone; then I got scared and went to my buddy manager at the Store; we disabled all data on my iPhone. The iPhone is now dead and I'm writing on the forum in the hope, that someone will magically advise me how to repair it"

MacRR · 11-09-2009, 08:39 AM

They also just discovered this worm we're sure to hear about ad nauseum tomorrow... sigh

http://tinyurl.com/iPhonePwnWorm

Quadra 610 · 11-09-2009, 08:42 AM

Quote:

Originally Posted by ivan.rnn01

Sure, it's "techies". Those of the kind "I just jailbroke and killed my iPhone; then I got scared and went to my buddy manager at the Store; we disabled all data on my iPhone. The iPhone is now dead and I'm writing on the forum in the hope, that someone will magically advise me how to repair it"

Hehe, yes, that's true . . .

Quadra 610 · 11-09-2009, 08:43 AM

Quote:

Originally Posted by MacRR

They also just discovered this worm we're sure to hear about ad nauseum tomorrow... sigh

http://tinyurl.com/iPhonePwnWorm

Damn you. Now it's 26,251,291 views. LOL

SS3 GokouX · 11-09-2009, 08:49 AM

Misleading.

This exploit requires the user to jailbreak their phone and install SSH through Cydia/whatever. I’d imagine most people would never install SSH. The article makes it sound like every jailbroken iPhone is vulnerable to this exploit.

foljs · 11-09-2009, 08:51 AM

Excuse me if I'm wrong, but this seems like a programmer's failure to me, not an end user one.

Most of the jailbreaking is done with programs that run on your Mac or PC and automate the process. The end user can be completely clueless about what happens under the surface.

So, why don't these programs also ASK THE USER to provide a password at jailbreaking time, and then set the SSH to use it on installation?

Why do they rely on the default password and an obscure warning to the user to "change it later"? End users using these tools don't know what an SSH server is.

Another thing that software can automate and programmers forgot to take advantage of.

Quadra 610 · 11-09-2009, 08:55 AM

Quote:

Originally Posted by foljs

Excuse me if I'm wrong, but this seems like a programmer's failure to me, not an end user one.

Most of the jailbreaking is done with programs that run on your Mac or PC and automate the process. The end user can be completely clueless about what happens under the surface.

So, why don't these programs also ASK THE USER to provide a password at jailbreaking time, and then set the SSH to use it on installation?

Why do they rely on the default password and an obscure warning to the user to "change it later"? End users using these tools don't know what an SSH server is.

Another thing that software can automate and programmers forgot to take advantage of.

I trust the haxie community like I trust a pitbull high on angel dust.

teckstud · 11-09-2009, 09:06 AM

Quote:

Originally Posted by doyourownthing

i know...when did ai become apple iphone hacker digest? jeez...

I second that emoticon.

plovell · 11-09-2009, 09:12 AM

This is NOT an iPhone worm. It's a jailbreak worm.

Resist the temptation to generate page hits with sensational headlines. It works for a while and then you lose all your readers.

Credibility is hard-won but easily lost. Don't squander (any more of) it.

Gazoobee · 11-09-2009, 09:14 AM

Quote:

Originally Posted by AppleInsider

The iPhone's first worm -- a playful, wallpaper-changing prank that only affects jailbroken phones -- could be a sign of more dangerous things to come. ...

Maybe I'm the only one, but this sounds like a good thing all round to me.

- discourages hackers - check
- punishes the stupid and lazy - check
- justifies Apples stance on jail-breaking - check
- encourages Apple to put in even more security - check

What's not to love about this?

Gazoobee · 11-09-2009, 09:16 AM

Quote:

Originally Posted by geekdad

This is the same Charlie Miller that compromised the Mac in 2008 Pwn 2 Own in 2 minutes.....
Then did it again in Pwn 2 Own 2009 with the same Safari exploit but this time it took him 10 seconds..........

Before you elevate Charlie Miller to the status of Jesus Christ, it's worth mentioning that he spent months and weeks on those hacks *before* the contest. The amount of time it took him on the day of the conference is essentially irrelevant.

plovell · 11-09-2009, 09:17 AM

I understand that Android has all the things that iDon't, so maybe its open by default on port 22 with a standard password?

iPhone isn't open so maybe iDont is? Maybe??

DistortedLoop · 11-09-2009, 09:18 AM

Most of the analogies thrown about re: jailbreaking are not accurate. The real flaw is user ignorance, just like most security flaws.

It doesn't matter what system you're on, if you open port 22 (ssh), or any port, actually, to the world, and leave default account names and passwords in place, you're asking for trouble. This is true of Macs, Linux, Windows, iPhones, your basic consumer network routers, etc.

Several neighbor's WiFi routers are wide open with the admin/admin or whatever brand they use' default password. These people are no different to jailbreakers who turn on ssh and don't change passwords. It's ignorance of what doors they're installing and what locks are required.

It's not like hiding your front door key on a string that's attached to the lock. It's more like installing a door that wasn't there in the first place, with a simple lock that's easily picked by anyone. Don't install a door without a proper lock if you're going to be in a bad neighborhood (the Internet and open ports).

My jailbroken iPhone is secure, and stable, thank you very much. I know the risks and the rewards, the blanket condemnations of jailbreaking are little more than FUD.

Gazoobee · 11-09-2009, 09:20 AM

Quote:

Originally Posted by foljs

Excuse me if I'm wrong, but this seems like a programmer's failure to me, not an end user one .... So, why don't these programs also ASK THE USER to provide a password at jailbreaking time, and then set the SSH to use it on installation?

Why do they rely on the default password and an obscure warning to the user to "change it later"? End users using these tools don't know what an SSH server is. ...

You're wrong. This is crazy talk.

SSH is not a kids toy. If you install it on your phone, don't read the manual, and don't know what you are doing, it's 100% your fault if you don't secure it.

It's like your saying that if a kid steals the keys to an F-14 and tries to fly it, it's not his responsibility if he gets hurt. Sure it is. He was playing with a bunch of stuff he didn't understand and breaking the law in the process.

DistortedLoop · 11-09-2009, 09:21 AM

Quote:

Originally Posted by Gazoobee

Before you elevate Charlie Miller to the status of Jesus Christ, it's worth mentioning that he spent months and weeks on those hacks *before* the contest. The amount of time it took him on the day of the conference is essentially irrelevant.

Well, yes and no. It took months to develop the hack, but once it's developed, and published, any script kiddie can then use the exploit in a matter of seconds.

That's the fear here for jailbreakers with port 22 open; the hacker has published the source, now more malicious folks who hadn't thought of the delivery method now only need to insert their payload.

DistortedLoop · 11-09-2009, 09:31 AM

One thing none of these articles around the net are failing to mention is that only certain networks are vulnerable.

In the US, AT&T apparently blocks incoming connections to port 22. End of story as far as this worm goes for the cellular network and AT&T users.

Those who attach to public WiFi networks are at risk, I suppose.

Bottom line, if you think you need the ssh server installed on your iPhone, change BOTH your 'root' and 'mobile' accounts' passwords and turn off the ssh server when you don't actually need it running. This really should be made more clear in the installation process.

ivan.rnn01 · 11-09-2009, 09:41 AM

Quote:

Originally Posted by Gazoobee

You're wrong. This is crazy talk.

SSH is not a kids toy. If you install it on your phone, don't read the manual, and don't know what you are doing, it's 100% your fault if you don't secure it.

It's like your saying that if a kid steals the keys to an F-14 and tries to fly it, it's not his responsibility if he gets hurt. Sure it is. He was playing with a bunch of stuff he didn't understand and breaking the law in the process.

The guy was presumably trying to involve posters in discussing details. No good.

slu · 11-09-2009, 09:45 AM

If you don't want to jailbreak, fine. But stop spreading FUD about jailbreaking.

Saying things like "people only do it to be cool", "you sacrifice stability", "there are enough apps in the apps store" and "these locks keep us safe" is just plain not true.

There are many very useful apps for jailbroken iPhones that do not sacrifice stability at all. Simple things like calender and email information on you lock screen or a Google Voice App (why I jailbreak).

And Apple has these "locks" not to protect you, but to protect themselves. They want you locked into the App Store. Apple is out to protect it's investment.

Also, you have to actively install SSH for this exploit to work and if you have installed it, you can also shut off SSH. And when you install SSH, almost every guide I've seen tells you to change your passwords.

If you don't want to jailbreak and are happy with your phone, that is fine. I am glad you are happy. I'll never understand the vigilant anti-jailbreakers who come to message boards like this one and denigrate people who jailbreak their phones, spread mis-information, and in this case basically gloat that they get what they deserve. What do you get out of this? Is it that oh so smug feeling that you are somehow better or smarter than others? You know better? Well, nobody really wants to hear it. Unless you have something useful to add, why don't you just take your smug somewhere else?

On topic. does anyone know how you get this exploit? Do you have to click a link in an email or go to a website? The article was lacking this important detail.

geekdad · 11-09-2009, 09:48 AM

Quote:

Originally Posted by Quadra 610

What does this have to do with a jailbroken iPhone (other than it's a Charlie Miller production)?

Hacking with physical contact of the computer is data mining.

At pwn to own, the first day was to hack the Mac remotely. Not one person could do it. Nobody. No remote access, no viruses, nothing. Nobody can hack Macs remotely. To win the hacker needed local access to the machine. For his hack to work, it required somebody manually navigating to a site with malicious content.

For this hack to work in the real world, you would need to physically click a link to the malicious site somehow (in an email maybe, or a link via IM or whatever). Social Engineering. It relies on the ignorance of the computer user to do the hacker's job for him, because he can't do it himself.

Can your Mac get hacked remotely? No.

Will the hacker drive to your house and personally point your web browser to his site to infect your Mac? Not likely.

Make of that what you will.

What does it have to do with Charlie Miller???
Did you miss this part??
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
This summer, Apple quickly fixed a text messaging exploit that could have affected all iPhones. The exploit took advantage of the fact that SMS can send binary code to a phone. That code is automatically processed without user interaction, and can be compiled from multiple messages, allowing larger programs to be sent to a phone.

The exploit, discovered by security researcher Charlie Miller, exposed the iPhone completely, giving hackers access to the camera, dialer, messaging and Safari.

Miller also, back in 2007, discovered the iPhone's first security flaw. It allowed malicious Web sites to take advantage of flaws within the Safari Web browser.
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >

hillstones · 11-09-2009, 09:49 AM

Quote:

Originally Posted by plovell

This is NOT an iPhone worm. It's a jailbreak worm.

Resist the temptation to generate page hits with sensational headlines. It works for a while and then you lose all your readers.

Credibility is hard-won but easily lost. Don't squander (any more of) it.

This is a rumor site, not a news site. If you expect credibility, you came to the wrong place. But there are many readers here that believe everything they see, then get really upset when the rumors never come true.

It is an iPhone worm because it does not affect any other handset, but only for the morons that jailbroke their phone and compromised all the security. So they get what they deserve.

geekdad · 11-09-2009, 09:53 AM

Quote:

Originally Posted by Gazoobee

Before you elevate Charlie Miller to the status of Jesus Christ, it's worth mentioning that he spent months and weeks on those hacks *before* the contest. The amount of time it took him on the day of the conference is essentially irrelevant.

First I would never elevate anyone to Jesus Christ.....there was only one........
Second you are correct Charlie worked on the same exploit for 2 years. He used it to win in Pwn 2 Own 2008 then in 2009 with the same exploit that went un patched from Apple.

anonymouse · 11-09-2009, 10:04 AM

Quote:

Originally Posted by SS3 GokouX

Misleading.

This exploit requires the user to jailbreak their phone and install SSH through Cydia/whatever. I’d imagine most people would never install SSH. The article makes it sound like every jailbroken iPhone is vulnerable to this exploit.

It's actually that it installs sshd, and in an insecure configuration -- sshd should be configured not to allow root login at all. A pretty dumb thing to do by whoever wrote the jailbreak code.

On the other hand, ssh can be very nice to have on your iPhone, if you have servers you sometimes need to get into while you are at, say, the beach.

anonymouse · 11-09-2009, 10:07 AM

Quote:

Originally Posted by geekdad

First I would never elevate anyone to Jesus Christ.....there was only one........
Second you are correct Charlie worked on the same exploit for 2 years. He used it to win in Pwn 2 Own 2008 then in 2009 with the same exploit that went un patched from Apple.

You're still being a bit misleading here. It's not like he walked in in 2008 and said to himself, "Oh, what if I try this? ... Voila! I'm in!" Clearly there was a significant amount of research and preparation involved, prior to demonstrating the exploit.

That it went unpatched is a justified criticism of Apple.

tjs · 11-09-2009, 10:21 AM

Quote:

Originally Posted by Quadra 610

Damn you. Now it's 26,251,291 views. LOL

Make that 26,251,292... Dang. See how easy this social engineering is?

Gazoobee · 11-09-2009, 10:33 AM

Quote:

Originally Posted by geekdad

First I would never elevate anyone to Jesus Christ.....there was only one.........

My apologies for the Jesus Christ comment.

It's hard for me to remember that a lot of Americans are touchy about that, and that probably half the people on this forum are from the USA. It's a common enough thing to say where I live and no anti-religious offence was intended.

geekdad · 11-09-2009, 10:46 AM

Quote:

Originally Posted by anonymouse

You're still being a bit misleading here. It's not like he walked in in 2008 and said to himself, "Oh, what if I try this? ... Voila! I'm in!" Clearly there was a significant amount of research and preparation involved, prior to demonstrating the exploit.

That it went unpatched is a justified criticism of Apple.

You are correct he did extensive work to produce the exploit.......

11-09-2009, 07:59 AM	#2
Quadra 610 Registered User Join Date: Nov 2008 Posts: 2,091	jailbreaking = making your own iPhone vulnerable, deliberately. It's self-hacking. So where's the risk to the average user? How is it really news that people who hack their iPhones (against Apple's recommendations) are getting into trouble because of it? Pehaps it's useful to warn them of the obvious . . . (Formerly LTD on Neowin.net) (currently *LTD* on Macrumors.com) Mac OS users have made a conscious technology choice and are therefore typically better informed than their peers. -- Paul Thurrott, winsupersite.com, December 06, 2004 Last edited by Quadra 610; 11-09-2009 at 08:05 AM..

11-09-2009, 08:27 AM	#9
Jon T Registered User Join Date: Aug 2008 Posts: 39	And... How many times in the press will they fail to mention the 'jailbroken' part, or downplay it completely..? Here we have the difference between Android ie Windows, and iPhone ie Mac....

11-09-2009, 09:12 AM	#23
plovell Registered User Join Date: Feb 2009 Posts: 17	NO !!! Not an iPhone worm This is NOT an iPhone worm. It's a jailbreak worm. Resist the temptation to generate page hits with sensational headlines. It works for a while and then you lose all your readers. Credibility is hard-won but easily lost. Don't squander (any more of) it.

11-09-2009, 09:17 AM	#26
plovell Registered User Join Date: Feb 2009 Posts: 17	Does Droid have port 22 open with predictable password?? I understand that Android has all the things that iDon't, so maybe its open by default on port 22 with a standard password? iPhone isn't open so maybe iDont is? Maybe??

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

11-09-2009, 07:48 AM	#1
*AppleInsider* Kasper's Automated Slave Join Date: Nov 1997 Posts: 6,171	First-known iPhone worm 'Rickrolls' jailbroken Apple handsets The iPhone's first worm -- a playful, wallpaper-changing prank that only affects jailbroken phones -- could be a sign of more dangerous things to come. A hacker who identifies himself as "ikex" created the worm, which changes the user's wallpaper to a picture of 1980s pop star Rick Astley, who sang the 1987 hit "Never Gonna Give You Up." The software includes the message: "ikee is never gonna give you up." The term jailbreaking refers to a hack that allows users to run software not approved by Apple on the iPhone. It can grant users the ability to install custom wallpapers and themes, enable tethering, or unlock the handset for use on a non-approved carrier. The ikex worm is simply a prank known as "Rickrolling," an Internet bait-and-switch meme when users expect to see a video on a certain topic, only to find themselves watching Astley's cheesy 1987 music video. According to Forbes, the worm does nothing malicious. "The world's first iPhone worm is also hardly a true criminal exploit," the report said. "Instead, it seems to be half warning, half prank. Ikee's author, who identifies himself or herself as 'ikex' in the worm's source code, also wrote in the code that "People are stupid, and this is to prove it so," adding that users should read their phones' manuals." For now, the worm is said to be spreading among jailbroken iPhones in Australia. It affects only users who did not change their default SSH password, which allows file transfers between phones. "It's not that hard, guys," ikex wrote in the source code. "But hey who cares its only your bank details at stake." Mikko Hyppönen, researcher with F-Secure, discussed the worm on his company's Web site. It lets users know how to change their root password, and also warns that the software could become more dangerous. "The creator of the worm has released full source code of the four existing variants of this worm," he said. "This means that there will quickly be more variants, and they might have nastier payload than just changing your wallpaper or might try password cracking to gain access to devices where the default password has been changed." This summer, Apple quickly fixed a text messaging exploit that could have affected all iPhones. The exploit took advantage of the fact that SMS can send binary code to a phone. That code is automatically processed without user interaction, and can be compiled from multiple messages, allowing larger programs to be sent to a phone. The exploit, discovered by security researcher Charlie Miller, exposed the iPhone completely, giving hackers access to the camera, dialer, messaging and Safari. Miller also, back in 2007, discovered the iPhone's first security flaw. It allowed malicious Web sites to take advantage of flaws within the Safari Web browser. [ View this article at AppleInsider.com ]

11-09-2009, 08:27 AM	#10
ivan.rnn01 Registered User Join Date: Dec 2008 Location: France Posts: 993	There's something, which I just fail to understand. It's explained thousands of times and crystal clear to everyone, that being a regular legal owner of locked iPhone guarantees the smooth and issueless function of the device and decent assistance at any moment. App Store has 100 times richer collection of applications, than any illegal stores do. And people jailbreak "to be cool"... Stupid, no?

11-09-2009, 08:37 AM	#14
womble2k2 Registered User Join Date: Sep 2009 Posts: 40	I think in the early days of iPhone, Jailbreaking was done more to get Apps on the phone as the App Store did not exist at that time, but with 100,000 Apps on the App Store, I cannot see a reason for it. It is like saying, I've bought a Mac as they don't get virus's, install Windows on the Mac but without virus software (as Mac's don't get virus's) and then complain if your windows installation becomes infected. Macs do get virus's if they are not running the OS that is designed to run on them, with all of the security measures Apple designs. Jailbreaking is like putting your door key on a string behind your letterbox. People can reach in, grab the string and then the key and open the door to your house!

11-09-2009, 08:39 AM	#16
MacRR Registered User Join Date: Nov 2006 Posts: 330	They also just discovered this worm we're sure to hear about ad nauseum tomorrow... sigh http://tinyurl.com/iPhonePwnWorm

11-09-2009, 08:49 AM	#19
SS3 GokouX Registered User Join Date: Nov 2001 Posts: 59	Misleading. This exploit requires the user to jailbreak their phone and install SSH through Cydia/whatever. I’d imagine most people would never install SSH. The article makes it sound like every jailbroken iPhone is vulnerable to this exploit.

11-09-2009, 08:51 AM	#20
foljs Registered User Join Date: Mar 2009 Posts: 21	Excuse me if I'm wrong, but this seems like a programmer's failure to me, not an end user one. Most of the jailbreaking is done with programs that run on your Mac or PC and automate the process. The end user can be completely clueless about what happens under the surface. So, why don't these programs also ASK THE USER to provide a password at jailbreaking time, and then set the SSH to use it on installation? Why do they rely on the default password and an obscure warning to the user to "change it later"? End users using these tools don't know what an SSH server is. Another thing that software can automate and programmers forgot to take advantage of.

11-09-2009, 09:18 AM	#27
DistortedLoop Registered User Join Date: Nov 2007 Posts: 84	Most of the analogies thrown about re: jailbreaking are not accurate. The real flaw is user ignorance, just like most security flaws. It doesn't matter what system you're on, if you open port 22 (ssh), or any port, actually, to the world, and leave default account names and passwords in place, you're asking for trouble. This is true of Macs, Linux, Windows, iPhones, your basic consumer network routers, etc. Several neighbor's WiFi routers are wide open with the admin/admin or whatever brand they use' default password. These people are no different to jailbreakers who turn on ssh and don't change passwords. It's ignorance of what doors they're installing and what locks are required. It's not like hiding your front door key on a string that's attached to the lock. It's more like installing a door that wasn't there in the first place, with a simple lock that's easily picked by anyone. Don't install a door without a proper lock if you're going to be in a bad neighborhood (the Internet and open ports). My jailbroken iPhone is secure, and stable, thank you very much. I know the risks and the rewards, the blanket condemnations of jailbreaking are little more than FUD.

11-09-2009, 09:31 AM	#30
DistortedLoop Registered User Join Date: Nov 2007 Posts: 84	One thing none of these articles around the net are failing to mention is that only certain networks are vulnerable. In the US, AT&T apparently blocks incoming connections to port 22. End of story as far as this worm goes for the cellular network and AT&T users. Those who attach to public WiFi networks are at risk, I suppose. Bottom line, if you think you need the ssh server installed on your iPhone, change BOTH your 'root' and 'mobile' accounts' passwords and turn off the ssh server when you don't actually need it running. This really should be made more clear in the installation process.

11-09-2009, 09:45 AM	#32
slu Registered User Join Date: Aug 2004 Location: Buffalo Posts: 22	If you don't want to jailbreak, fine. But stop spreading FUD about jailbreaking. Saying things like "people only do it to be cool", "you sacrifice stability", "there are enough apps in the apps store" and "these locks keep us safe" is just plain not true. There are many very useful apps for jailbroken iPhones that do not sacrifice stability at all. Simple things like calender and email information on you lock screen or a Google Voice App (why I jailbreak). And Apple has these "locks" not to protect you, but to protect themselves. They want you locked into the App Store. Apple is out to protect it's investment. Also, you have to actively install SSH for this exploit to work and if you have installed it, you can also shut off SSH. And when you install SSH, almost every guide I've seen tells you to change your passwords. If you don't want to jailbreak and are happy with your phone, that is fine. I am glad you are happy. I'll never understand the vigilant anti-jailbreakers who come to message boards like this one and denigrate people who jailbreak their phones, spread mis-information, and in this case basically gloat that they get what they deserve. What do you get out of this? Is it that oh so smug feeling that you are somehow better or smarter than others? You know better? Well, nobody really wants to hear it. Unless you have something useful to add, why don't you just take your smug somewhere else? On topic. does anyone know how you get this exploit? Do you have to click a link in an email or go to a website? The article was lacking this important detail.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)