Jailbreak My Bank Account!

Mac OS is famously hard to write viruses and trojans for, but the iPhone is a different story. In late 2009 a wave of trojans started targeting jailbroken iPhones, and one of them went specifically after banking data. As more banks shipped official iPhone apps to make mobile banking easier, the attack surface for that kind of malware only got bigger.

What Is Jailbreaking?

Jailbreaking lets an iPhone or iPod Touch run unofficial code outside Apple's App Store, usually through third-party installers like Cydia. It's distinct from SIM unlocking, and it isn't illegal on its own – though it does open the door to pirated apps, which is, and it voids Apple's warranty on the device. None of that is the actual security problem here; the problem is what jailbreaking leaves switched on by default.

The Trojan

What started as a prank – a worm that just changed jailbroken phones' wallpaper to a photo of Rick Astley – escalated quickly into real banking-phish malware. The most serious of the bunch, nicknamed "113 prep," is written in Python and lets an attacker connect to a victim's phone from Windows, macOS, or Linux. From there it can pull almost anything off the device: messages, stored banking credentials, PayPal logins, whatever else happens to be sitting in an app.

Crucially, none of this works by exploiting iOS itself. It only works against phones that have been jailbroken and still have the default SSH password left untouched.

Securing Your SSH Password

If you've jailbroken your iPhone, this is the one thing worth doing right now: change the default root password before anything else. It takes about two minutes.

1. Install MobileTerminal from Cydia if you don't already have it – search for it under the Search tab and confirm the install.
2. Open MobileTerminal from the home screen.
3. Type su root and hit return. When prompted for a password, enter the default, alpine.
4. Type passwd and hit return.
5. Enter a new password – something that isn't a dictionary word – and hit return.
6. Retype the new password to confirm.

That's it. With the default SSH password changed, none of the SSH-based trojans doing the rounds can walk straight in.