Nasty iPhone Worm Hints at the Future

As smart phones become smarter, malicious code will find a friendlier home.

As mobile phones get more powerful, the threat of serious attacks against such devices increases, security experts warn. This week, cybercriminals moved closer to proving this point--exploiting a weakness in modified iPhones to spread a worm programmed to steal banking information. Some experts say the worm may be a sign that criminals are getting more savvy about hacking mobile devices.

Credit: Technology Review

Last Saturday, researchers at several security firms reported that the new worm, dubbed "Ikee.B" or "Duh," spreads using the default password for an application that can be installed on modified versions of the iPhone. Once the device has been compromised, the worm grabs text messages, and searches for banking authorization codes used by at least one bank, before sending the codes to a central server. Earlier this month, another iPhone worm was released. It exploited the same password weakness to spread itself, but did not try to steal personal information.

"The banking [attack] is new to mobile devices," says Chet Wisniewski, a senior security advisor at antivirus firm Sophos. "It goes through your phone, grabbing all your text messages, and sends them off to a server in Lithuania."

Since the attack affects only the small number of iPhones that have been "jail broken"--modified to run nonapproved software--the worm will likely inconvenience only a few people. Yet some researchers say the worm confirms that attacks against mobile users are evolving, and that cybercriminals are targeting the personal and financial information kept on portable devices. The ability to communicate with a central command-and-control server--a characteristic more commonly associated with hijacked PCs--also makes such software more dangerous.

Story continues below

This past summer, at the Black Hat Security Briefings conference in Las Vegas, Charlie Miller, a consultant with Independent Security Evaluators, demonstrated a way to remotely attack iPhones using the short message service (SMS) protocol. Miller says it's only a matter of time before cybercriminals find a way to infect phones that haven't been jail broken, vastly increasing the potential scale of an infection. "A [more serious] worm against an iPhone or any other mobile device is going to happen," Miller says. "It is going to happen to [Google's] Android and iPhone and everything else. As more bad guys do research into the mobile platforms, these devices are going to get attacked."

The evolution of the Ikee.B or Duh worm can be traced back to early attacks against mobile devices. In 2000, Timofonica, a relatively simple virus that spread between desktop computers and servers, also had the ability to spam mobile phones in Spain with text messages. In 2004, Cabir, the first mobile-phone-only worm, was released. Cabir could jump automatically between Nokia handsets.