Monday, November 9, 2009

iPhone Worm Found Rickrollin' in the Wild

A new worm targeting Apple's iPhone has been headlining the news as of late. This iPhone worm, dubbed as Ikee, has been infecting Jailbroken iPhones (hacked iphones allowing installation of applications outside of iTunes) all over Australia, and infected users found themselves having iPhones with a photo of Rick Astley as its wallpaper, and a message stating that "ikee is never going to give you up". This is actually a very popular prank among internet users and is known as Rickrolling.

This worm specifically targets Jailbroken phones with a root login password still set to the default password alpine. This opens a hole for hackers to exploit since Jailbroken phones use an SSH daemon which allows for remote connections.

In the case of Ikee, the worm scans a hardcoded list of IP ranges belonging to several Australian Telecom companies for vulnerable iPhones. Once a vulnerable iPhone has been found, the worm copies several files including a copy of itself to the iPhone, and changes its wallpaper to a photo of Rick Astley. It then disables the SSH service to prevent reinfection, and calls for another scan on the network to look for other vulnerable iPhones.

Jailbroken iPhones obviously pose some serious risks. If you have decided to do so, make sure you have changed your SSH password (instructions for changing the password can be found here courtesy of Cydia) and be aware that you have a greater risk of getting infected than non - Jailbroken iPhones.