thanks to our friends from iPhone Spanish This good tutorial comes to us so that we can secure our data on the iphone.

(Anti) Hack an iPhone / iPod

In this tutorial we are going to see how is it possible to enter a foreign iPhone / iPod via Wi-Fi, to learn how we can prevent them from entering ours. It is not about revealing a security hole, but about reporting the situation, which is known, public and published, and providing solutions to avoid it.

One of the common actions after unlocking an iPhone is to install OpenSSH through Cydia or Installer or any other application that activates the service SSH on our iPhone. OpenSSH It is a popular and widely used tool, but it is also a back door that allows anyone to access our iPhone (or someone else's) if the correct security measures do not exist. On our iPhone, OpenSSH is usually used to access the file system of the iPhone operating system (see tutorial).

OpenSSH is a demon which starts automatically, listening through port 22 (by default). That is, it starts when the iPhone starts up and it will attend to any request made on that port. It's like having a door on 22nd Street in our city, which when we do "knock" is going to ask us who we are, and if we guess the password, then inside. You only need to know the city, the street, the door and the password ...


In order to access a foreign iPhone, both the PC (yours) and the iPhone (foreign) are required to be connected to a Wi-Fi network, and this is possible due to the number of free and open Wi-Fi accesses there are. , starting with airports, fairs, offices, hospitals, etc ... It should be noted that access to a foreign iPhone can be done, installing the necessary tools, through another iPhone. How comfortable it is from a PC or laptop is clear, but it is not an essential requirement.

As an introduction, it must be explained that the iPhone / iPod is a "computer" that has its operating system, and therefore has its own user access accounts. Specifically, on the iPhone there are two accounts, root y mobile devices. The latter only present on iPhones. The bad news is the passwords are public and known to all iPhones / iPods: alpine (the latest) or dottie (the oldest).

The second requirementKnowing the IP that the iPhone has to attack is relatively simple. It turns out that the iPhone always has port 62078 open that it uses to sync with iTunes. It is therefore quite probable that if I find a device that has port 62078 and port 22 open, it is an Apple device that has an SSH daemon installed such as OpenSSH. So, with a program that scans ports (in the test we used nmap ), I look for devices with those ports open within the address range to which I myself am connected. In the case of the test, my PC is connected to a Wi-Fi network which has provided me with an IP address, 10.0.0.172. Let's see if I can find my iPhone on the same network (10.0.0.x).

Bingo! I've already found it. We already have the second requirement, know your IP: 10.0.0.83.

The third requirement We have checked it in the previous step, since we have looked for devices with port 22 (SSH) open. We are going to verify that what is behind port 22 is really an SSH service installed on an iPhone. We will open a terminal window (in the example we have used WinSPC) and we will try to connect to the IP 10.0.0.83 through port 22 to see who responds:

And Bingo !, it asks us for the username, which we know: root

And after confirming the password (alpine or dottie, depending on the model), we enter the bowels.

At this point, we have full access rights to all the information on the iPhone, of course knowing where everything is stored, something that is also known and published.

Recapping: We were in a place, with a Wi-Fi connection, which provided us with an IP. This is the only information we have needed to get started. We have done a port scan on the network in which we were connected, looking for devices connected to the same Wi-Fi with port 22 (SSH) and 62078 open, and we have located (at least) one device (to my surprise, I discovered some more). We already had his IP. We have connected via SSH to said device, and we have overcome the barrier of credentials, because they are public (root + alpine or dottie). And without further ado, we are accessing the iPhone / iPod of a "stranger".

And if someone gets into my iPhone / iPod, what can they do to me?
Well, he can access your email, your contacts, your photos, your SMS, everything, and he can also delete any information he wants, leaving your iPhone without anything if he wants, that is, he can do you a lot of harm. They could take the contacts file (/private/var/root/Library/AddressBook.sqlitedb), copy it to their PC and then safely access the entire contact book... to give an example. The same with email, calendar, text messages, photos, ... and cookies. The latter, cookies, are a problem, because with them you can access, for example, the GMail account, the bank account, and in general anyone that requires a password. Also, if you are currently browsing, entering keys and passwords, you could, using the appropriate program (for example Tcpdump ), capture them. It could even introduce you to the iPhone, with tools like untroubled, a back door in case you disable SSH access. Paranoia? Maybe .. real, unfortunately yes.

Now positive part.

How to protect ourselves from outside access

If you haven't unlocked your iPhone or iPod, you don't have to worry about a thing. But, if you have it unlocked (see tutorial), as I put at the beginning, for them to access our iPhone / iPod, they require certain conditions, on which we can put obstacles:

That the iPhone has Wi-Fi enabled
It is clear, that we do not have Wi-Fi activated, they will not enter us. Here's the first way around it, keeping Wi-Fi off. But of course, at some point you will activate it to use it, but in the meantime, we prevent it from being activated 24 hours a day. In addition, keeping Wi-Fi deactivated you will save a lot of battery and avoid revealing the IP that allows, apart from entering, to perform denial of service attacks among other things.

Know your Wi-Fi IP
This requirement is unavoidable. If we are connected to our iPhone via Wi-Fi, a port scanner will detect us. We have no firewall on the iPhone to prevent it.


That the iPhone has OpenSSH installed
Surely we will not be all day tricking the guts of the iPhone. OpenSSH is a great tool, but it doesn't need 24 hours a day. The recommendation, as with Wi-Fi, is that you have this application uninstalled and install it when you need it. Surely this cumbersome step would not be done by anyone, but if you are looking for maximum security, without a doubt, if you do not have OpenSSH, they will not enter you.

Another more comfortable option is to have the application installed BossPrefs that will allow us to comfortably activate or deactivate SHH / among many other things) without having to uninstall and reinstall OpenSSH, or Toggle SSH (through Cydia).


Know the username and password for access
As we have said, the username and password are public. It should be noted that apart from the user name "root" there is a second, with more limited access, called "mobile" and whose password is the same as used by "root". What we can (must) do is change the password to both accounts. How? Entering terminal mode (for example with Putty ), and running the command Passwd. It will ask us for the password twice (remember that you will not see it written on the screen). We will repeat the process with the "mobile" account.

And is it not enough to change the passwords? No. Discovering passwords is sometimes quite easy, either by social engineeringBy brute force….

Remember: If you don't have Wi-Fi enabled or you don't have OpenSSH installed, you don't have to worry. If you both have them activated, the only thing that will save you is having changed the passwords. There are more options, but the level of paranoia would already border on worrying.