Dutch cracker targets iPhones

Author: Gareth Halfacree
Published: 3rd November 2009
Comments (20) Stumble
Dutch cracker targets iPhones

Dutch iPhone users - at least those with jailbroken handsets - are being targeted by a cracker demanding €5 to secure their handsets.

A Dutch cracker has been holding iPhone users on the T-Mobile network to ransom, demanding a payment in order to release his control over their handsets.

According to an article over on Ars Technica, the cracker has been running port scans across T-Mobile Netherlands' IP range in order to find devices with SSH enabled - something which gets turned on when a user 'jailbreaks' their iPhone in order to enable locked features or install software from alternative sources.

While one of the steps in jailbreaking an iPhone is to change the default SSH password once the service is enabled, many users fail to do so - and it is these insecure devices which the un-named cracker is targeting. Victims of the attack find themselves receiving an SMS from their own handset warning them that their iPhone has "been hacked because it's really insecure!"

A further warning alerts users that the cracker "can access all your files," and advises that the message - and related security hole - won't go away "until your iPhone's secure."

Included in the message is a link to a website, which offers a solution to the issue - pay the cracker €5 via PayPal in order to receive instructions on closing the security hole. The cracker, however, insists that he is doing the user a favour: on the site, he claims that "if you don't pay, it's fine by me," but warns that "the way I got access to your iPhone can be used by thousands of others—they can send text messages from your number (like I did), use it to call or record your calls, and actually whatever they want, even use it for their hacking activities!"

Because the security hole is opened up by deliberately bypassing controls put in place by Apple, it's important that end-users take responsibility back from the company for securing their device. Users of jailbroken iPhones should ensure that they change the root password to something non-trivial, and think about disabling the SSH service when it's no longer required.

Do you believe that the cracker is offering a public service, or is he merely taking advantage of the fact that many iPhone users - even those who have the know-how to jailbreak their handset - are unlikely to think about the security implications of their actions? Share your thoughts over in the forums.
Quote proxess 3rd November 2009, 15:38
What a way to make a quick buck.
Quote mjm25 3rd November 2009, 15:40
many companies do this as a legitimate business activity.

"we've found X holes in your security. pay us and we'll fix it for you"
Quote badders 3rd November 2009, 15:44
The same guy has posted instructions on how to secure it for free, apparently.
Quote null_x86 3rd November 2009, 16:02
Quote:
Originally Posted by badders
The same guy has posted instructions on how to secure it for free, apparently.

How is moving, chowning and chmodding a jpg fixing a security hole?? I get the plist part, but a jpg? Come on...
Quote badders 3rd November 2009, 16:09
Quote:
Originally Posted by null_x86
How is moving, chowning and chmodding a jpg fixing a security hole?? I get the plist part, but a jpg? Come on...
The jpg stuff is to remove the static background the guy sets when going into your phone.

Step 4 is the key step if you're taking preventative measures.
Quote macroman 3rd November 2009, 16:52
LOL How ironic :)
Quote scawp 3rd November 2009, 16:53
Well hes not doing anything malicious at least so why not make a quick buck, like he says himself much worse could be done.

I'm know nothing of Dutch Laws however and if they have anything like the Computer Misuse Act 1990 he could be in some s**t. Lets hope not friendly hackers make me moist.
Quote patchcable 3rd November 2009, 17:57
I don't condone his actions he crossed the line after accessing the phones he found after the port scan. The first thing i did was override the alpine password. At least it has raised awareness i guess.
Quote Mr. Oizo 3rd November 2009, 22:01
I think that he just wanted to hack those iPhone's, gain €5 per iPhone, and since that is illegal over here (in the Netherlands) he decided to tell that all he wanted to do is "helping" those people. Tellling that their security is bad.
Quote 1ad7 3rd November 2009, 23:26
Epic, and sadily I feel Im a "Secure" person but I would of likely not changed it as well. I say leave the guy alone its such a witty crime!
Quote wuyanxu 3rd November 2009, 23:51
i think he's doing the right thing.

no novice should attempt at jailbreaking without studying about it. jailbreaking is easy but can be deadly as well.

the Ars article is wrong though, SSH is installed manually afterwards through Cydia, and password should be manually configured afterwards using Mobile Terminal from its default: "alpine".
Quote LordPyrinc 4th November 2009, 00:10
Lesson learned class? Don't go all amateur with your l33t hacking skills on your phone, only to leave yourself vulnerable to the people that really know what they are doing.
Quote ZERO <ibis> 4th November 2009, 01:02
He may have haxored my zors but at least I still have my uber micro!

When will noobs learn...
Quote [USRF]Obiwan 4th November 2009, 08:35
To add some more hacking to this news item. Another hacker has now come forward that warns the dutch jailbreak iphone users that using this Dutch hack to access the iphones, but now the new hacker has shown that he could connect to the itunes server via the hacked phoe and buying tunes on the credits of the hacked iphone user! you can read the news item on the (translated) Dutch tweakers.net website
Quote crazyceo 4th November 2009, 09:06
Clearly, this freaky deaky Dutch dude is getting back at all the stoners for being too wasted to sort their iPhone out themselves. You see, this is what happens to a society that allows the open use of recreational drugs in public places without the cold hard fist of the law to control its citizens.

Fight the lowest common denominator, Brothers!
Quote BLC 4th November 2009, 09:46
I say they got what they deserved - moreso if they actually paid money to this guy. There is no excuse for not securing your network-connected device any more, no matter what shape that takes: iPhone, laptop, desktop, router, etc. I'm sick of people not taking responsibility for security and then crying out against "hackers". If you give someone a great big honeypot of an opportunity, don't you think they'll take it? It's the same damn thing with identity fraud too: if you throw your bank statements, credit card statements, sensitive data, etc, in the rubbish without shredding or disposing of it properly, don't you think there's a chance that someone is going to try and steal it? Ignorance is no excuse any more.

You don't need to be a completely paranoid freak with tinfoil wrapped round your head, but taking some basic damned security precautions should be a no-brainer. Especially when you're going to hack your iPhone and violate the terms of your contract/user agreement/whatever, and doubly so when the instructions tell you to change the default bleedin' password!
Quote scarrmrcc 4th November 2009, 13:32
Quote:
Originally Posted by wuyanxu
i think he's doing the right thing.

no novice should attempt at jailbreaking without studying about it. jailbreaking is easy but can be deadly as well.
.

i agree about him doing the right thing... and about the DEADLY part. when i jailbroke my iPhone... it went rogue and killed my neighbor's dog!
Quote thehippoz 4th November 2009, 15:13
Quote:
Originally Posted by ZERO <ibis>
He may have haxored my zors but at least I still have my uber micro!

When will noobs learn...

:D sounds about right

reminds me of all the open or wep wireless connects you can get into around any highschool
Quote SMIFFYDUDE 4th November 2009, 17:38
Phwarr look at that Dutch cracker.
Quote SNIPERMikeUK 4th November 2009, 23:41
He is a disgrace to hackers lol....
Log in

You are not logged in, please login with your forum account below. If you don't already have an account please register to start contributing.







Mobile Phones

LG Arena ReviewHTC Magic Review

Compare over 250 mobile phones &
52,000 deals!



Broadband

Mobile Broadband

Compare over 100 broadband & mobile broadband deals online!

Dragonage