In 2006, researchers at the University of Toronto and Microsoft confirmed that even short-ranged and short-lived Bluetooth connections between phones could, in theory, be used to spread a wireless worm. "Starting a Bluetooth worm outbreak is relatively easy once a vulnerability is found. An attacker can bring an infected device into a typical urban mall and discover many potential victims," the researchers wrote in a related paper.

The iPhone, and other smart phones, are a more attractive target for hackers because they resemble mini PCs. The devices are always connected to the Internet, run third-party applications, and store information that is potentially valuable to cybercriminals.

Normally, however, exploiting the iPhone is not that easy. The new worm employed a weakness introduced by an application called OpenSSH that can be used to connect to the phone remotely. This application uses the default password "alpine," and the worm used this default password to wriggle between handsets.

"This is trivial--there is no shell code, no buffer overflow, nothing," says Miller. "It took me two weeks to write the [code] for the SMS thing, but I could have written [Ikee.B] in, like, five minutes."

The attacks that have targeted the iPhone in the last month have also focused on jail-broken devices. The modification process to jail break a phone removes the code that prevents users from loading whatever applications they want, but also removes much of the security that prevents malicious code from running on the device. "The iPhone has all these layers of defense, but when you jail break your phone, you break every single one of them," Miller says.

The evolution of such hacking will continue, Miller says, although the current crop of iPhone attack code has a long way to go. The new worm does little to hide its activity, for example. And, by sending data over wireless networks, as well as aggressively attempting to infect other phones, the worm also quickly runs down the compromised phone's battery.

"Because the phone is trying to connect all the time, users that get infected with this thing are going to know," says Sophos' Wisniewski.