RTFM: Jailbroken iPhones get iRickrolled due to weak SSH access

There is a good deal of hype over the “iPhone Virus” that hit jailbroken iPhones in various parts of Australia. The problem is that the ones affected by the “ikee iPhone Worm” have only themselves to blame. This is why playing with technology can be a double edged sword. Recently, we talked to Ash, the ikee creator, and got his views on things.

The ikee Worm story starts early Friday morning local time for those in Sydney (GMT +10). Written in C, the ikee project started out as a lesson in learning more about the iPhone platform, with a special focus on compiling and writing applications under Linux, Ash told The Tech Herald in his interview.

The ikee Worm has quickly become one of Australia’s most talked about iPhone modifications online. The first sign someone has been hit by it is the stunning picture of Web meme and 80’s icon Rick Astley. Essentially, the iPhones were all Rickrolled in record time. Ash said that he has no way to know how many were hit by ikee, but he can guess that its more than the initial 100 that were directly infected from his iPhone.

The news spread like wildfire, thanks to coverage from Sophos and Mashable, as well as the rapid fire conversations on Twitter over the weekend. Users who have jailbroken iPhones or iPod Touch devices and an active SSH daemon running with root/alpine access are the only ones vulnerable to ikee. It’s important to note that ikee only targets jailbroken devices.

[Note: There are very few reports of iPod Touch devices being hit. Mostly this has affected iPhone users. I wanted to clear that up. -Steve]

The Worm will scan the 3G IP range the device is on, and depending on what it discovers, will attempt infect other devices. What it is looking for are SSH Daemons, which it will attempt to connect to. Once infected, the Worm will disable SSH, alter the background of the device to Astley’s image, and leave the comment, “ikee is never going to give you up.” If the network you’re on uses NAT (Network Address Translation), then you are safe most reports confirm.Read more