New iPhone worm steals online banking codes, builds botnet

Computerworld - Hackers have borrowed a tactic from the world's first iPhone worm to build a botnet that steals data, including online banking credentials, from jailbroken Apple smartphones.

A new worm, dubbed "Duh" by U.K.-based security firm Sophos, is related to the "ikee" worm released earlier this month only in its approach, not in its code, said Chester Wisniewski, a senior security advisory with Sophos.

"It's different code, but the same conceptually," Wisniewski said today.

Both ikee and the new Duh worms take advantage of the default password used by the SSH (secure shell) Unix utility, which is installed by some users after they've "jailbroken" their iPhones. That term refers to the process of modifying an iPhone so its owner can download and install software outside Apple's official App Store channel. SSH lets users connect to their iPhone remotely over the Internet via an encrypted channel.

Duh changes the default SSH password of "alpine" to its own "ohshit" password, Wisniewski said.

Two weeks ago, noted iPhone and Mac vulnerability researcher Charlie Miller warned users that jailbreaking their iPhone puts them at greater risk from attack.

The Duh worm uses the command-and-control strategy employed by traditional PC-based botnets to hijack data from the compromised device, then send it to a central server operated by the attackers, Wisniewski said. The server appears to be based in Lithuania, but the worm itself was probably crafted by Dutch hackers.

One task of Duh is to steal SMS-based authentication codes that some banks use to protect customers who are conducting financial transactions from their iPhones.

"Historically, hackers haven't been able to defeat the mTAN technology," said Wisniewski, talking about the mobile transaction authentication numbers that some banks send to customers as a second layer of authentication. When a user logs into a bank that supports mTAN, he or she receives a six-digit code that must be entered within the next 90 seconds to prove ownership of the account.

Last month, a variant of the Zbot Trojan watched for TANs on hijacked PCs, and used silent instant messaging to transmit the codes to waiting hackers, who then had a short window during which they could preempt the legitimate account owner to access funds. "Duh is using a similar concept," said Wisniewski. "It's looking for incoming SMS with mTANs, capturing those mTANs in real-time and sending them to the command-and-control server. That gives the criminals time to log on using the mTAN."

Although the Duh worm's resulting botnet may be among the first to target iPhones, Wisniewski downplayed the danger. "You're likely to know you've been hacked," he said, noting that Duh's constant network activity quickly depletes the iPhone's battery. "And anyone playing by Apple's rules is, of course, safe," Wisniewski added. Since only jailbroken iPhones can be compromised by Duh, he recommended that users restore their devices to the most up-to-date Apple firmware by connecting it to their PC or Mac, then accessing iTunes.

But even though Duh strikes only a subset of iPhones, the worm and its botnet illustrates an often-overlooked fact, Wisniewski argued. "People don't realize that an iPhone is essentially an entire Unix-based computer in their pocket," he said.

"It's probably not practical to run spam bots on a phone, not with the battery drain, but data theft like this is a sign of what practical future worms will be like on the mobile platforms," Wisniewski concluded.

Read more about Security in Computerworld's Security Topic Center.