First iPhone Worm Affects Jailbroken iPhones in Australia

iPhone Background Image Used in Worm

The worm, which could have spread to other countries although we have no confirmed reports outside Australia, is capable of breaking into jailbroken iPhones if their owners have not changed the default password after installing SSH. Once in place, the worm appears to attempt to find other iPhones on the mobile phone network that are similarly vulnerable, and installs itself again.

In analyzing the worm, Sophos has found multiple variants, as well as numerous comments within the code suggesting that the worm is an experiment to draw attention to the risks faced by users who have not taken appropriate steps to secure their devices.

The source code is littered with comments from the author suggesting the worm has been written as an experiment. One of the comments berates affected users for not following instructions when installing SSH, because if they had changed the default password the worm would not have been able to infect them.

A forum poster known as ike_x on the Australian forum where the worm was first discussed has taken credit for the exploit and has been assisting affected users with removing it from their systems.