How To Clean Up The Duh iPhone Worm

The latest iPhone worm is much more malicious than the last one.

Duh installer script

As if that weren't bad enough, the Duh worm can also steal the SMS-based mobile transaction authentication numbers (known as mTANs) used by some banks to authenticate customers' financial transactions.

If a hacker can grab an mTAN from your phone, then he has a window of opportunity to break into your online bank account. The Duh iPhone worm gives him that ability in real-time.

Both Ikee and the Duh worm exploit the default password used by SSH, which is often installed by users after they have jailbroken their iPhones. Sophos researcher Paul Ducklin discovered that Duh changes the password from "alpine" to "ohshit" -- if you didn't know that new password, then hackers would have control of your iPhone, and you would be effectively locked out from cleaning it up.

In a blog post, Ducklin explains how to disinfect iPhones infected with Duh:

"To disinfect your iPhone, you should login as root with the password ohshit and remove at least the following files:

/private/var/mobile/home/sshd /private/var/mobile/home/cydia.tgz /private/var/mobile/home/inst /private/var/mobile/home/syslog /private/var/mobile/home/duh However, since the directory /private/var/mobile/home does not exist on regular, uninfected iPhones, you may as well remove the entire directory and any subdirectories. Remove the file /etc/rel while you are about it.

"

The only reason these worms have been able to infect iPhones in the first place, of course, is that the users who chose to jailbreak their iPhones failed to follow the advice to change the default password.

Do yourself a favor -- if you really want to jailbreak your iPhone, then make sure you change the password:

"Assuming you are logged in as root, you can use the passwd command, like this:

# passwd Changing password for root. New password: Retype new password: # passwd mobile Changing password for mobile. . . . .

"

Graham Cluley is senior technology consultant at Sophos, and has been working in the computer security field since the early 1990s. When he's not updating his other blog on the Sophos website, you can find him on Twitter at @gcluley. Special to Dark Reading.