Well, this hacker has quite the sense of humor.
Reports started spreading this weekend that iPhone users in Australia had been falling victim to "ikee," a worm that replaces default wallpaper with a picture of Rick Astley, the British pop singer whose song "Never Gonna Give You Up" has gained eternal infamy thanks to the mainstreaming of the "Rickrolling" prank craze. The photo is accompanied by the message "ikee is never gonna give you up," and it's apparently quite difficult to remove. According to security firm Sophos, this is the first worm detected that targets the iPhone.
The vulnerability is pretty specific: the phones must be jailbroken in order to be affected, and it appears to spread by searching an infected phone's contacts to find other jailbroken-phone users who have installed the Unix software SSH (secure shell) but haven't yet changed their passwords from Apple's default root password, "alpine."
Sophos says that it has not heard of any occurrences of the worm outside Australia, and that while it doesn't appear to do anything worse than irritate and embarrass affected users, that it highlights the vulnerabilities that jailbroken phones face.
Facebook security chief Max Kelly has assured members in a blog post that the social network is "fighting the good fight" when it comes to several malware attacks discovered on the site in recent days.
"We spent most of last night working on a fix for a worm, which was targeting people on Facebook and placing messages on walls urging users to view a video that pretends to be hosted on a Google or YouTube Web site," Kelly wrote. "Less than .002 percent of people on Facebook have been affected, all of whom we notified and suggested steps to remove the malware."
The worm was first flagged by security firm Sophos, just days after another one had been identified by Kaspersky Labs.
Kelly said Facebook appreciates the efforts of watchdogs. "If we get a report of a bug or a hole from a user, a security researcher, a reporter, blogger, or anyone, we check it out and fix it as quickly as possible," he wrote. "In fact, we appreciate it when help comes our way from the many security experts and organizations out there."
Sophos and other security firms have warned that social networks such as Facebook and MySpace are particularly rife breeding grounds for security attacks: they have massive user bases, plenty of outside developers working on the site, and lots of ways (messages, wall posts) to spread malware to unwitting members.
Facebook recommends that members follow a few basic security measures: report spam postings, install the proper Mac or Windows software in the event of a malware infection, and never share your Facebook password.
That last piece of advice will be tougher for Facebook to recommend as Facebook Connect, which lets external sites use Facebook login credentials, grows more commonplace.
Sophos, a security software and research firm, has warned that social network Facebook is the battleground for a new malware attack targeting members' comment "walls."
Public wall posts purporting to be from someone on a user's friends list invite the user to click on some kind of video or image, and the URL appears to lead to something hosted on Google.com. That's a spoof--it really directs to a grinning photo of a court jester sticking out its tongue--and a downloaded Trojan. Sophos has not said what the worm then does.
Facebook representatives were not immediately available for comment.
Sophos says that this is probably not the same as a social-network worm that Kaspersky Labs flagged last week; Kaspersky confirmed on Friday that the two are different.
Additionally, Sophos says it has not yet completed its investigation of the issue and has said that the worm may not be restricted to Facebook. "Whether this really is a Facebook worm, and not simply malware being distributed via Facebook spam remains to be seen," a blog post by Sophos researcher Fraser Howard read.
In the past, Sophos has warned of social networks' potential as Petri dishes for malicious attacks, and has put out a general warning to companies that security issues might be a graver issue than productivity when it comes to choosing whether to block access to these sites at the office. "Companies need to make their own mind up as to whether they want to allow their users to access websites like Facebook and MySpace during office hours," Sophos analyst Graham Cluley said in a release.
"If workers are allowed to be given access to these sites then it's vital that they do not put their personal and corporate data at risk, and are protected from web-based infections."
This post was updated at 12:14 p.m. PT with comment from Kaspersky Labs.
- prev
- 1
- next
