We have created a video on how the iPhone/Eeki worm targeting iPhones works.
You can see it here:
As you can see in the video, this malware first checks it is not already running on the device. To do so, it checks whether the following file exists:
/var/lock/bbot.lock
This may help you know if you are infected; if the information is in your device, it means the worm is there.
Next, it changes the device host and stops the SSH daemon.
It then tries to spread on the subnet the phone is connected to and tries to create a random IP range. It tries pre-established ranges corresponding to certain companies’ IP addresses:
Once the IP address is created, it remotely accesses the jailbroken iPhone device, establishing an SSH connection and using the default root key, included in all iPhoneOS devices (1G, 2G and 3G Iphone and ipod touch devices). If access is denied, it tries to create a random IP again and repeats the process until it obtains a valid IP from a vulnerable victim.
Once the victim is found with the previous credentials, it obtains a remote session and copies itself to the affected phone, adding:
/System/Library/LaunchDaemons/com.saurik.Cydia.Startup.plist
/System/Library/LaunchDaemons/com.ikey.bbot.plist
to run on restart.
It stops the SSH service that has caused the infection. Finally, it copies a photo of Rick Astley and uses the image as the device wallpaper.
Â
“Thanks to Gorka RamÃrez and Francisco Berenguer for the information and the videoâ€.
[...] that affected devices based on the iPhone operating system, it was the worm iPhone/Eeki. We wrote a blog post explaining how the worm worked, and prepared a video where you could see how it was infected and [...]
[...] algunos ejemplares de malware especialmente diseñados para esta plataforma. El pasado año, PandaLabs advertÃa sobre un ejemplar de gusano, iPhone/Eeeki, dispuesto a infectar dispositivos iPhone que habÃan sido modificados para poder [...]
[...] designed specifically to target these platforms is beginning to attract more attention. Last year, PandaLabs warned about a worm, iPhone/Eeeki, able to infect jailbroken iPhones (i.e. those that have been tampered with in order [...]
[...] il malware progettato per attaccare queste piattaforme sta attirando ancora maggiore attenzione. Lo scorso anno, i laboratori di Panda avevano segnalato la presenza del worm iPhone/Eeeki, capace di colpire i [...]
[...] algunos ejemplares de malware especialmente diseñados para esta plataforma. El pasado año, PandaLabs advertÃa sobre un ejemplar de gusano, iPhone/Eeeki, dispuesto a infectar dispositivos iPhone que habÃan sido modificados para poder [...]
[...] Laboratoarele anti-malware de la Panda Security au demonstrate, recent, că malware-ul proiectat pentru a infecta iPhone-urile poate compromite, de asemenea, echipamentele iPad, a anunţat producătorul de soluţii de securitate. [...]
[...] ins Visier von Malware-Programmierern geraten. Schon im November 2009 haben die PandaLabs den Eeeki-iPhone-Wurm entdeckt, der gejailbreakte iPhones infiziert. „Jailbreak“ bedeutet, die Beschränkungen [...]
[...] algunos ejemplares de malware especialmente diseñados para esta plataforma. El pasado año, PandaLabs advertÃa sobre un ejemplar de gusano, iPhone/Eeeki, dispuesto a infectar dispositivos iPhone que habÃan sido modificados para poder [...]
[...] algunos ejemplares de malware especialmente diseñados para esta plataforma. El pasado año, PandaLabs advertÃa sobre un ejemplar de gusano, iPhone/Eeeki, dispuesto a infectar dispositivos iPhone que habÃan sido modificados para poder [...]
[...] ano passado o PandaLabs alertou para um worm, o iPhone/Eeeki, capaz de infectar iPhones desbloqueados ilegalmente (por exemplo através da [...]
[...] that affected devices based on the iPhone operating system, it was the worm iPhone/Eeki. We wrote a blog post explaining how the worm worked, and prepared a video where you could see how it was infected and [...]
[...] that affected devices based on the iPhone operating system, it was the worm iPhone/Eeki. We wrote a blog post explaining how the worm worked, and prepared a video where you could see how it was infected and [...]