iPhone users at risk

This is officially the first ITW (in the wild) Worm for the iPhone. It is affecting users that have ‘jailbroken‘ their device and still have the default password ‘alpine’.

The Worm dubbed sshgate by security company Intego has several variants, sshgate.d being the most annoying since it overwrites cydia , an app used by jailbroken iPhones.

Currently the Worm’s payload is to change the user’s wallpaper, but we could imagine a more destructive or invasive behaviour in the future.

Jailbreaking an iPhone is illegal and the numbers on how many iPhones have been hacked is not clear. Current mitigation would be changing the default password on the device.

For users that have already been infected, there is no Anti Virus software available as an app from the iPhone store. However, all is not lost, since the user can run a security solution such as Virus Barrier from their Mac while they plug in their Phone with the USB cord.

The iPhones are becoming more interesting of a target for malware authors, with already 7.3 million units sold in Q4 2009.

Jerome Segura