New iPhone worm steals online banking codes, builds botnet

"Duh" worm strikes only jailbroken iPhones, but ups earlier ante by snatching banking credentials

Hackers have borrowed a tactic from the world's first iPhone worm to build a botnet that steals data, including online banking credentials, from jailbroken Apple smartphones.

A new worm, dubbed "Duh" by U.K.-based security firm Sophos, is related to the "ikee" worm released earlier this month only in its approach, not in its code, said Chester Wisniewski, a senior security advisory with Sophos.

"It's different code, but the same conceptually," Wisniewski said today.

Both ikee and the new Duh worms take advantage of the default password used by the SSH (secure shell) Unix utility, which is installed by some users after they've "jailbroken" their iPhones. That term refers to the process of modifying an iPhone so its owner can download and install software outside Apple's official App Store channel. SSH lets users connect to their iPhone remotely over the Internet via an encrypted channel.

Duh changes the default SSH password of "alpine" to its own "ohshit" password, Wisniewski said.

Two weeks ago, noted iPhone and Mac vulnerability researcher Charlie Miller warned users that jailbreaking their iPhone puts them at greater risk from attack.

The Duh worm uses the command-and-control strategy employed by traditional PC-based botnets to hijack data from the compromised device, then send it to a central server operated by the attackers, Wisniewski said. The server appears to be based in Lithuania, but the worm itself was probably crafted by Dutch hackers.

One task of Duh is to steal SMS-based authentication codes that some banks use to protect customers who are conducting financial transactions from their iPhones.

"Historically, hackers haven't been able to defeat the mTAN technology," said Wisniewski, talking about the mobile transaction authentication numbers that some banks send to customers as a second layer of authentication. When a user logs into a bank that supports mTAN, he or she receives a six-digit code that must be entered within the next 90 seconds to prove ownership of the account.

Last month, a variant of the Zbot Trojan watched for TANs on hijacked PCs, and used silent instant messaging to transmit the codes to waiting hackers, who then had a short window during which they could preempt the legitimate account owner to access funds. "Duh is using a similar concept," said Wisniewski. "It's looking for incoming SMS with mTANs, capturing those mTANs in real-time and sending them to the command-and-control server. That gives the criminals time to log on using the mTAN."

Although the Duh worm's resulting botnet may be among the first to target iPhones, Wisniewski downplayed the danger. "You're likely to know you've been hacked," he said, noting that Duh's constant network activity quickly depletes the iPhone's battery. "And anyone playing by Apple's rules is, of course, safe," Wisniewski added. Since only jailbroken iPhones can be compromised by Duh, he recommended that users restore their devices to the most up-to-date Apple firmware by connecting it to their PC or Mac, then accessing iTunes.

But even though Duh strikes only a subset of iPhones, the worm and its botnet illustrates an often-overlooked fact, Wisniewski argued. "People don't realize that an iPhone is essentially an entire Unix-based computer in their pocket," he said.

"It's probably not practical to run spam bots on a phone, not with the battery drain, but data theft like this is a sign of what practical future worms will be like on the mobile platforms," Wisniewski concluded.

Tags Duh wormiPhone

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)

Comments

Comments are now closed.

Latest News Articles

Most Popular Articles

Follow Us

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Resources

Best Deals on GoodGearGuide

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?