Dutch ISP identified malicious iphone worm

“Many customers with jailbroken phones have been found running unknown software on their phones which is trying to compromise other iPhone users at other telecommunications providers,”

According to a report, Dutch ISP has identified a worm that installs a backdoor on jailbroken iPhones and makes them part of a botnet. Malicious worm targets jailbroken iPhones whose owners have not changed the default password. Furthermore, worm has a tendency to change root password for the device; hence making it harder to get control on device.

The worm tries to propagate by scanning a variety of IP ranges, including those used by carriers T-Mobile, UPC in the Netherlands, and Optus in Australia. The worm is especially active when it has access to wi-fi networks.

According to F-Secure Chief Research Officer Mikko Hypponen, the initially best way to identify that either worm is active or not on your phone is to access 92.61.38.16 IP address. Admins who find this IP address being accessed have good reason to believe they may have a problem. Moreover, it has also been noticed that infected device’s battery life is extremely short because worm generate so many connections.

Infected iPhones should be reset to the factory firmware using Apple’s iTunes.