New iPhone worm steals online banking codes, builds botnet
'Duh' worm strikes only jailbroken iPhones, but ups earlier ante by snatching banking credentials
Computerworld - Hackers have borrowed a tactic from the world's first iPhone worm to build a botnet that steals data, including online banking credentials, from jailbroken Apple smartphones.
A new worm, dubbed "Duh" by U.K.-based security firm Sophos, is related to the "ikee" worm released earlier this month only in its approach, not in its code, said Chester Wisniewski, a senior security advisory with Sophos.
"It's different code, but the same conceptually," Wisniewski said today.
Both ikee and the new Duh worms take advantage of the default password used by the SSH (secure shell) Unix utility, which is installed by some users after they've "jailbroken" their iPhones. That term refers to the process of modifying an iPhone so its owner can download and install software outside Apple's official App Store channel. SSH lets users connect to their iPhone remotely over the Internet via an encrypted channel.
Duh changes the default SSH password of "alpine" to its own "ohshit" password, Wisniewski said.
Two weeks ago, noted iPhone and Mac vulnerability researcher Charlie Miller warned users that jailbreaking their iPhone puts them at greater risk from attack.
The Duh worm uses the command-and-control strategy employed by traditional PC-based botnets to hijack data from the compromised device, then send it to a central server operated by the attackers, Wisniewski said. The server appears to be based in Lithuania, but the worm itself was probably crafted by Dutch hackers.
One task of Duh is to steal SMS-based authentication codes that some banks use to protect customers who are conducting financial transactions from their iPhones.
"Historically, hackers haven't been able to defeat the mTAN technology," said Wisniewski, talking about the mobile transaction authentication numbers that some banks send to customers as a second layer of authentication. When a user logs into a bank that supports mTAN, he or she receives a six-digit code that must be entered within the next 90 seconds to prove ownership of the account.
Last month, a variant of the Zbot Trojan watched for TANs on hijacked PCs, and used silent instant messaging to transmit the codes to waiting hackers, who then had a short window during which they could preempt the legitimate account owner to access funds. "Duh is using a similar concept," said Wisniewski. "It's looking for incoming SMS with mTANs, capturing those mTANs in real-time and sending them to the command-and-control server. That gives the criminals time to log on using the mTAN."
Although the Duh worm's resulting botnet may be among the first to target iPhones, Wisniewski downplayed the danger. "You're likely to know you've been hacked," he said, noting that Duh's constant network activity quickly depletes the iPhone's battery. "And anyone playing by Apple's rules is, of course, safe," Wisniewski added. Since only jailbroken iPhones can be compromised by Duh, he recommended that users restore their devices to the most up-to-date Apple firmware by connecting it to their PC or Mac, then accessing iTunes.
But even though Duh strikes only a subset of iPhones, the worm and its botnet illustrates an often-overlooked fact, Wisniewski argued. "People don't realize that an iPhone is essentially an entire Unix-based computer in their pocket," he said.
"It's probably not practical to run spam bots on a phone, not with the battery drain, but data theft like this is a sign of what practical future worms will be like on the mobile platforms," Wisniewski concluded.
- Apple will 'set the world on fire' with iPhone 6 sales
- The other Apple economy: $2B in devices on eBay
- Apple sends users scrambling for OS X Yosemite
- Apple grows Mac sales by 18% on the back of the MacBook Air
- What to listen for during Apple's earnings call today
- Timeline: How Apple's iOS gained enterprise cred
- Apple and IBM: A winning combo for IT
- IBM and Apple ties go way back
- Apple quickly counters China claim of iPhone spying
- China calls the iPhone and iOS 7 threats to national security
Read more about Security in Computerworld's Security Topic Center.
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!