112 chapter 7 Cell Phones, Personal Digital Assistants THe aTTaCKs In early November 2009, news sites and technology blogs E were all abuzz with news of an attack on Apple iPhones. Several Dutch users of jailbroken iPhones reported that their devices had been attacked and a ominous message left on their lock screen wallpaper indicating a Web site to visit to find out how to secure their devices. The Web site demanded five euros for instructions on how to secure the phones. After news broke, the attacker very quickly removed the demand for payment and posted instructions on how to secure the phones as well as an apology to users he had attacked. As guessed, his preferred method was default root passwords on jailbroken phones. This was the first public demonstration of the capacity for this vulnerability, but certainly not the first time it had been quietly abused. Later in November, another iPhone attack appeared in Australia F utilizing the same attack vector. Except this time, the attack was automated and could spread automatically from phone to phone via Wi-Fi networks that vulnerable devices shared. The Ikee worm, as it was known, was the brainchild of Ashley Towns, a 21-year-old student. The worm infected jailbroken iPhones through default SSH passwords, but this time changed the background image to that of Rick Astley and the ringtone to that of the song "Never Gonna Give You Up" of RickRoll fame. The worm would then attempt to upload itself and do the same to other phones on networks joined by the infected device. Reports only indicate 100 phones or less were infected, but considering the small percentage of iPhones that are jail- broken, this number is interesting. While it is unclear if the actions of the Dutch extortion attempt had anything to do with inspiring the Ikee worm, it did bring its author to the attention of iPhone application developer Mogeneration who hired Towns as a developer after an interview process after hearing about his worm. They claim it was not due to the worm and that he passed their iPhone developer test with flying colors as any other employee would have to. There is great debate if hiring him is rewarding negative behavior and sets a dangerous precedent. G Some see it as positive reinforcement of a negative action and that if there is the hint of a reward, others will attempt to copy that behavior in hopes being rewarded. The end result may be a great many people attempting to write worms for the iPhone or other devices in hopes of landing a job. Some see it as asking the fox to guard the hen house, hiring nOTe It is still unclear as to whether or not the worm could spread via 3G connections. Many providers differ in how devices are presented to the Internet at large. Many providers of 3G gateways heavily fire wall the incoming connections for the IP space used by wireless devices. They also may deny interclient communication. While this prevents some attack vectors, some providers may not be as restrictive and allow the types of connections required to spread this type of malware. Much of it depends on the infrastructure of the carrier that the device is connecting to and can vary from provider to provider. E www.sophos.com/blogs/gc/g/2009/11/03/hacked-iphones-held-hostage-5-euros/ F www.sophos.com/blogs/gc/g/2009/11/09/worm-author-tells-media-initially-infected-100-iphones/ G www.sophos.com/pressoffice/news/articles/2009/11/iphone-worm-job.html