New iPhone worm steals online banking codes, builds botnet
'Duh' worm strikes only jailbroken iPhones, but ups earlier ante by snatching banking credentials
Computerworld - Hackers have borrowed a tactic from the world's first iPhone worm to build a botnet that steals data, including online banking credentials, from jailbroken Apple smartphones.
A new worm, dubbed "Duh" by U.K.-based security firm Sophos, is related to the "ikee" worm released earlier this month only in its approach, not in its code, said Chester Wisniewski, a senior security advisory with Sophos.
"It's different code, but the same conceptually," Wisniewski said today.
Both ikee and the new Duh worms take advantage of the default password used by the SSH (secure shell) Unix utility, which is installed by some users after they've "jailbroken" their iPhones. That term refers to the process of modifying an iPhone so its owner can download and install software outside Apple's official App Store channel. SSH lets users connect to their iPhone remotely over the Internet via an encrypted channel.
Duh changes the default SSH password of "alpine" to its own "ohshit" password, Wisniewski said.
Two weeks ago, noted iPhone and Mac vulnerability researcher Charlie Miller warned users that jailbreaking their iPhone puts them at greater risk from attack.
The Duh worm uses the command-and-control strategy employed by traditional PC-based botnets to hijack data from the compromised device, then send it to a central server operated by the attackers, Wisniewski said. The server appears to be based in Lithuania, but the worm itself was probably crafted by Dutch hackers.
One task of Duh is to steal SMS-based authentication codes that some banks use to protect customers who are conducting financial transactions from their iPhones.
"Historically, hackers haven't been able to defeat the mTAN technology," said Wisniewski, talking about the mobile transaction authentication numbers that some banks send to customers as a second layer of authentication. When a user logs into a bank that supports mTAN, he or she receives a six-digit code that must be entered within the next 90 seconds to prove ownership of the account.
Last month, a variant of the Zbot Trojan watched for TANs on hijacked PCs, and used silent instant messaging to transmit the codes to waiting hackers, who then had a short window during which they could preempt the legitimate account owner to access funds. "Duh is using a similar concept," said Wisniewski. "It's looking for incoming SMS with mTANs, capturing those mTANs in real-time and sending them to the command-and-control server. That gives the criminals time to log on using the mTAN."
Although the Duh worm's resulting botnet may be among the first to target iPhones, Wisniewski downplayed the danger. "You're likely to know you've been hacked," he said, noting that Duh's constant network activity quickly depletes the iPhone's battery. "And anyone playing by Apple's rules is, of course, safe," Wisniewski added. Since only jailbroken iPhones can be compromised by Duh, he recommended that users restore their devices to the most up-to-date Apple firmware by connecting it to their PC or Mac, then accessing iTunes.
But even though Duh strikes only a subset of iPhones, the worm and its botnet illustrates an often-overlooked fact, Wisniewski argued. "People don't realize that an iPhone is essentially an entire Unix-based computer in their pocket," he said.
"It's probably not practical to run spam bots on a phone, not with the battery drain, but data theft like this is a sign of what practical future worms will be like on the mobile platforms," Wisniewski concluded.
- Apple's CarPlay vs. MirrorLink: Is there a need for both?
- Apple's CarPlay to spark mobile apps war in your car
- iTunes is almost as big a biz as OEM Windows
- Icahn says 'I can't' and stops $50B fight over Apple stock buyback
- Lenovo-Moto deal's impact on Apple? Zip
- Office 365 turns one, but success is tough to tally
- Everyone bets on bigger iPhone for '14
- Apple's iPod business collapses as revenue becomes a rounding error
- Update: More than 1B smartphones were shipped in 2013
- Cook admits Apple blew the call on the iPhone 5C
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts