'Duh' Worm Targets Jailbroken iPhones

Hackers are using the worm to build a botnet that steals data, including online banking credentials.

By Kara Reeder | Posted Nov 24, 2009
Page of   |  Back to Page 1
Print ArticleEmail Article
  • Share on Facebook
  • Share on Twitter
  • Share on LinkedIn
Taking its cue from the world's first iPhone worm, a new worm, dubbed "Duh" by security firm Sophos, targets users who have jailbroken their iPhone but failed to change their root password.

Computerworld reports that this new worm is much more serious than the "Ikee" worm. Hackers are using the worm to build a botnet that steals data, including online banking credentials.

According to Chester Wisniewski, a senior security advisory with Sophos, "Duh" changes the default SSH password of "alpine" to "ohshit." It then uses the command-and-control strategy used by traditional PC-based botnets to steal data from the compromised device, including SMS-based authentication codes that some banks use to protect customers who are making financial transactions from their iPhones.

Ars Technica notes that non-jailbroken iPhones remain unaffected by these worms, or any real worms, for that matter.

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter