Jailbreaking an iPhone installs SSH with a default password of "alpine". Most people don't change the password. Thus, some hacker has written a worm (called "Ikee") that travels via SSH from iPhone to iPhone using that password.
This happens because your iPhone will try to reconnect to WiFi in the background. The scenario is that you get on an airplane to go somewhere. While on the airplane, your phone STILL IN YOUR LUGGAGE tries to connect to "gogoinflight" airplane WiFi service. Some other phone, also in its owner's luggage, likewise connects to the hotspot. That phone is infected with the worm. The worm will search out all iPhones, finds yours, connects using the password "alpine", and infects your phone. When you land and look at your phone, it has a background picture of Rich Astley.
Preventing infection is easy. The way I did it was to use the SSH client "Putty" on my Windows machine. I connected to the iPhone, and used the 'passwd' command-line program to change the default. You have to change the password for two accounts: "root" and "mobile".
Below is a screenshot of me changing the password. The screen doesn't show the passwords, but I've typed in "alpine" for the initial logon, and then when it asked me to choose a new password, I typed "letmein".**
** Of course that's not my password, but I'm not going to tell everyone my real password, am I?
** The new worm changes the password to "ohshit".
No comments:
Post a Comment