Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Guest Blog // Selected Security Content Provided By Sophos
What's This?
06:17 AM
Graham Cluley
Graham Cluley
Security Insights

How To Clean Up The Duh iPhone Worm

The latest iPhone worm is much more malicious than the last one.

The latest iPhone worm is much more malicious than the last one. Rather than the Ikee worm's trick of changing your wallpaper to a (for some disturbing) image of 1980s pop star Rick Astley, the Duh worm hijacks your jailbroken iPhone, turning it into part of a botnet.

As if that weren't bad enough, the Duh worm can also steal the SMS-based mobile transaction authentication numbers (known as mTANs) used by some banks to authenticate customers' financial transactions.

If a hacker can grab an mTAN from your phone, then he has a window of opportunity to break into your online bank account. The Duh iPhone worm gives him that ability in real-time.

Both Ikee and the Duh worm exploit the default password used by SSH, which is often installed by users after they have jailbroken their iPhones. Sophos researcher Paul Ducklin discovered that Duh changes the password from "alpine" to "ohshit" -- if you didn't know that new password, then hackers would have control of your iPhone, and you would be effectively locked out from cleaning it up.

In a blog post, Ducklin explains how to disinfect iPhones infected with Duh:

To disinfect your iPhone, you should login as root with the password ohshit and remove at least the following files:

/private/var/mobile/home/sshd /private/var/mobile/home/cydia.tgz /private/var/mobile/home/inst /private/var/mobile/home/syslog /private/var/mobile/home/duh However, since the directory /private/var/mobile/home does not exist on regular, uninfected iPhones, you may as well remove the entire directory and any subdirectories. Remove the file /etc/rel while you are about it.

The only reason these worms have been able to infect iPhones in the first place, of course, is that the users who chose to jailbreak their iPhones failed to follow the advice to change the default password.

Do yourself a favor -- if you really want to jailbreak your iPhone, then make sure you change the password:

Assuming you are logged in as root, you can use the passwd command, like this:

# passwd Changing password for root. New password: Retype new password: # passwd mobile Changing password for mobile. . . . .

Graham Cluley is senior technology consultant at Sophos, and has been working in the computer security field since the early 1990s. When he's not updating his other blog on the Sophos website, you can find him on Twitter at @gcluley. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
New FISMA Report Shows Progress, Gaps in Federal Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/21/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-08-22
In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the ...
PUBLISHED: 2019-08-22
In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace_scope to 1, which might increase risk because of the appearance that a protection mechanism is present when actually it is not.
PUBLISHED: 2019-08-22
The import-users-from-csv-with-meta plugin before for WordPress has directory traversal.
PUBLISHED: 2019-08-22
The import-users-from-csv-with-meta plugin before for WordPress has XSS via imported data.
PUBLISHED: 2019-08-22
The import-users-from-csv-with-meta plugin before for WordPress has XSS.