iPhone: New Worm STEALS Private Details!

Ikee's decendant is here with dangerous capability.  Worm was identified by F-Secure is claimed to have botnet capability.  This new worm targets all the jailbroken iPhones with OpenSSH installed.

What is botnet?
Bot = robot & Net = network
Botnet (Robot Network) runs malicious software automatically turning your computer into a bot controlled by a master computer.  Computers that are vulnerable are the main targets.

What can botnet do?
Botnet can steal personal information without your knowledge.
This worm can steal all information from Text Messages to all your Bank details.

What should iPhone user do?
Change your SSH password from default "alpine".  (Guide to change password)
Quote from ZDNetAsia

In a follow-up e-mail to ZDNet Asia, Ducklin said users should upon login check for a directory named "/private/var/mobile/home", which hosts the viral files. Files named "inst", "cydia.tgz", "duh", "sshd" and "syslog" ought be be removed to deactivate the malware, he said.

iPhone: Change Root Password

Change default root password from "alpine" after jailbreak iPhone to prevent infection with ikee worm.

Follow the steps below:

1. Launch mobile terminal. Enter "login" then enter login ID "root"
2. Enter default password "alpine"
3. Enter "passwd" and change the the password you prefer.  Reconfirm the new password.
4. Repeat set 1 to 3 but enter the login ID as "mobile

iPhone: Remove ikee worm

Jailbroken iPhones are at risk of being infected with ikee worm.

Most people (like me) should be affected by the first 3 A,B,C variant.

Which variant am I into? If you can find the files in the 1st scenario to delete, then u are having the variant A,B,C. Please make sure you have install MobileTerminal on your iPhone before you start.

1st Variant

• Launch MobileTerminal. Login to root "su root" with default password "alpine".
• Enter each line of command and press return key. Tip: Commands are case sensitive
• rm /bin/poc-bbot
• rm /bin/sshpass
• rm /var/log/youcanbeclosertogod.jpg
• rm /var/mobile/LockBackground.jpg or rm /var/mobile/Library/LockBackground.jpg)
• rm /System/Library/LaunchDaemons/com.ikey.bbot.plist
• rm /var/lock/bbot.lock
• Reboot iphone
• Change password and reinstall Open SSH.

2nd Variant

• Launch MobileTerminal. Login to root "su root" with default password "alpine".
• Enter below commands and press return key after each line. Tip: Commands are case sensitive
• rm /System/Library/LaunchDaemons/com.saurik.Cydia.Startup.plist
• rm /usr/libexec/cydia/startup
• rm /usr/libexec/cydia/startup-helper
• rm /usr/libexec/cydia/startup.so
• Reinstall Cydia with below command.
• su root
• Password: alpine
• get-app remove cydia
• get-app install cydia
• Reboot iPhone. Now you should be worm-free....