Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Rickrolling worm infects jailbroken iPhones lol

macshill

macshill

macrumors 6502
Original poster
Aug 22, 2008
469
0
London, Ontario, Canada
http://www.tgdaily.com/security-features/44575-rickrolling-worm-infects-jailbroken-iphones

23w2ntv.jpg


lol Aw... leave poor Rick alone. He knows he did wrong. lol :D
 
Haha... Wow... I guess some people have nothing better to do with their time.
 
I got rickrolled :(
Serves me right for not changing default SSH password, I'm glad it was nothing worse!

Oh well, fixed now. And password changed ;)
 
This works on Optus because users have public IP addresses by default. I'm assuming that AT&T uses NAT, which would explain why this hasn't been seen in the US (or other countries, for that matter).
 
We're going to be seeing more and more exploits/worms by people taking advantage of the stock userid and password to gain acess to iphones.
Everyone who JB's their iphone should change the password ASAP if they plan to use OpenSSH.
 
i dont actually plan on using SSH (my wifes iphone), but it was installed as part of the pwnage process..

is there a way to simply de-activate it? i'd heard one of boss pref's did this, but each time you re-start your phone, you must switch it off in boss prefs again..

i tried to change the default pw via my mac using terminal.. but i kept getting some weird error like below..

reading around the web i either have to edit the hosts file (do not want to do).. or simply trash it.. but what effect does trashing it have? will it affect anything? any other wireless devices?

thanks

Code: 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for ******************.net has changed,
and the key for the according IP address xx.xx.xxx.xxx
is unknown. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Please contact your system administrator.
Add correct host key in /Users/user/.ssh/known_hosts to get rid of this message.
Offending key in /Users/user/.ssh/known_hosts:5
RSA host key for **************.net has changed and you have requested strict checking.
Host key verification failed.
 
How to remove:

[10:33] <ikee> Sure, variants A-C store files in these directories
[10:34] <ikee> /bin/poc-bbot
[10:34] <ikee> /bin/sshpass
[10:34] <ikee> /var/log/youcanbeclosertogod.jpg
[10:34] <ikee> /var/mobile/Library/LockBackground.jpg
[10:35] <ikee> /System/Library/LaunchDaemons/com.ikey.bbot.plist
[10:35] <ikee> /var/lock/bbot.lock
[10:35] <ikee> using an rm (in SSH or mobile-terminal on those files will remove it)
[10:36] <ikee> then reboot the phone, change your password and reinstall SSH
[10:36] <ikee> For variant D its abit different
[10:36] <ikee> The locations are
[10:37] <ikee> /usr/libexec/cydia/startup
[10:37] <ikee> /usr/libexec/cydia/startup.so
[10:37] <ikee> /usr/libexec/cydia/startup-helper
[10:37] <ikee> /System/Library/LaunchDaemons/com.saurik.Cydia.Startup.plist
[10:38] <ikee> Of course cydia used these files previously so you may need to reinstall it after deleting these files
Click to expand...
 
dalvin200 said:
i dont actually plan on using SSH (my wifes iphone), but it was installed as part of the pwnage process..

is there a way to simply de-activate it? i'd heard one of boss pref's did this, but each time you re-start your phone, you must switch it off in boss prefs again..

i tried to change the default pw via my mac using terminal.. but i kept getting some weird error like below..

reading around the web i either have to edit the hosts file (do not want to do).. or simply trash it.. but what effect does trashing it have? will it affect anything? any other wireless devices?

thanks

Code: 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for ******************.net has changed,
and the key for the according IP address xx.xx.xxx.xxx
is unknown. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Please contact your system administrator.
Add correct host key in /Users/user/.ssh/known_hosts to get rid of this message.
Offending key in /Users/user/.ssh/known_hosts:5
RSA host key for **************.net has changed and you have requested strict checking.
Host key verification failed.
Click to expand...

Just trash it. It's fine. Basically your computer keeps a log of all the hosts you connect to and their addresses. This way if someone was to spoof the address of the server you were trying to connect to to steal your passwords you'd be notified before it lets you. The issue is that with Dynamic IP's this can come up a lot. Just trash your hosts file and you'll be fine. The command
Code: 
rm ~/.ssh/known_hosts
should do it. Then just try again. You'll be fine.
 
BRILLIANT... did the trick :) password changed... :D

ViViDboarder said:
Just trash it. It's fine. Basically your computer keeps a log of all the hosts you connect to and their addresses. This way if someone was to spoof the address of the server you were trying to connect to to steal your passwords you'd be notified before it lets you. The issue is that with Dynamic IP's this can come up a lot. Just trash your hosts file and you'll be fine. The command
Code: 
rm ~/.ssh/known_hosts
should do it. Then just try again. You'll be fine.
Click to expand...
 
I'm too lazy to change my password, but I should be fine because I turned off SSH through boss prefs settings....
 
xsecretfiles said:
I'm too lazy to change my password, but I should be fine because I turned off SSH through boss prefs settings....
Click to expand...

Yea... but sometimes it gets enabled when you respring.

Just change it... If you're too lazy to look up how, here is the command.
From MobileTerminal
Code: 
passwd
Enter your new password.
Code: 
su root
passwd
Enter new password.

If you're using SSH instead of MobileTerminal, make sure it's on and connect using:
Code: 
ssh root@iphoneip

Then run
Code: 
passwd
And enter the new password.
Code: 
passwd mobile
And enter the new password.

Takes almost no time and if you care about security at all... just do it or remove OpenSSH.

EDIT: And by the way, I recommend AGAINST removing OpenSSH. In fact I leave it enabled at all times with my changed password. My reason for doing so is that I've had certain settings I've changed or extensions I've installed that forced my phone into a reboot cycle. Because I left SSH enabled I was able to connect and fix my errors while it was booting. It saved me a restore.
 
ViViDboarder said:
And by the way, I recommend AGAINST removing OpenSSH. In fact I leave it enabled at all times with my changed password. My reason for doing so is that I've had certain settings I've changed or extensions I've installed that forced my phone into a reboot cycle. Because I left SSH enabled I was able to connect and fix my errors while it was booting. It saved me a restore.
Click to expand...

Agreed, been there, done that, it works !
 
ViViDboarder said:
Earlier today for you right? Haha. Saw that mobilesubtrate thread. :D
Click to expand...

Actually, I got lucky on that. Slowed the 3GS down a tad, but it did boot up and didn't trash my network settings.

My nemesis (sp-?) are the tethering fixes, mods or hacks.

No matter what I try, they just blow up my phone.

Had to pull out the moded files like CommCenter more than once.

Oh well.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back