Remember that iPhone virus we wrote about here yesterday? Guess what, Apple has finally patched it! Today Apple released iPhone 3.0.1 which patches the exploit. Security expert Charlie Miller demonstrated the iPhone SMS Exploit in the Black Hat conference just yesterday, and It would of taken hackers at least two weeks to come up with a virus.

I knew Apple would come up with a patch, but I’m surprised that they were able to release it right after the day Charlie Miller revealed the exploit. Charlie Miller had notified Apple 6 weeks ago and they didn’t do anything.

If you’re an iPhone, iPhone 3G, or iPhone 3GS user you must update to iPhone 3.0.1, iPhone 3G 3.0.1, or iPhone 3GS 3.0.1 firmware.

How to update to iPhone 3.0.1

1. Connect your iPhone to your PC
2. Launch iTunes and click Check for updates

3. Click Update

4. An iPhone OS 3.0.1 software update box should show up, click Next. Read the license agreement (if you want) then click Agree and your download will start.

5. The file size is 297.7 MB. Once the iPhone 3.0.1 firmware is finished downloading it will install on your iPhone. This update just fixes the SMS vulnerability, and it is highly recommended you update!

iPhone 3.0.1 Download Links

Having trouble downloading iPhone 3.0.1 firmware through iTunes? No problem, you can directly download your iPhone 3.0.1 IPSW file using any of the links below.

• iPhone 3.0.1 download (iPhone1,1_3.0.1_7A400_Restore.ipsw, 229 MB)
• iPhone 3G 3.0.1 download (iPhone1,2_3.0.1_7A400_Restore.ipsw, 230 MB)
• iPhone 3GS 3.0.1 download (iPhone2,1_3.0.1_7A400_Restore.ipsw, 298 MB)

If you know any one else using an iPhone, be sure to remind them to update to this latest firmware! There is no iPod Touch 3.0.1 firmware update, this update is just for iPhone users.

iPhone 3.0.1 Jailbreaking information

Yes, jailbreaking does work with the iPhone 3.0.1 update for all iPhone users, but a jailbreak for it has not been released yet. Stay tuned, we’ll make a post here once an iPhone 3.0.1 jailbreak is released.

Update: Here is an iPhone 3.0.1 jailbreak and unlock guide.

FOX News recently aired a video titled “Beware the Square“. A FOXNews.com reporter talks with Sascha Segan from PCMag.com. If you don’t know anything about the iPhone virus/iPhone SMS Hack, this video should answer your questions. Watch it!

Every single iPhone is at risk today. And so far there’s really no way to fix it. That’s the warning from a couple of cyber security experts who say they found a way to hijack and completely gain control of the phone. Here’s the iPhone. Mine has my niece in it. There is a flaw in the text messaging system, the hacker sends a message with just a single square character and after that could take control of the phone, and by the way it’s not just the iPhone, we’re told Microsoft Mobile and Google’s Android have the same issues. With us now is Sascha Segan, he is the lead analyst for mobile phones for PC Magazine and PCMag.com.

Reporter: Now I’m told that you can stop this by taking over yours by watching for these characters.

Sascha Segan: Well if you see first of all it’s not actually one message, it’s 500 messages but the first 499 are invisible. The only one you see is the very last one which has that square box character.

Reporter: But I know I received a message, but I don’t know what is?

Sascha Segan: No you don’t even see that you’ve received the message, but for some reason your phone seems very busy for a little while then you see the box character appear then you can either turn off your phone or put it in airplane mode and the hackers can’t do anything.

Reporter: But they’re in now though.

Sascha Segan: Well, they’re in but if your phone is off or in airplane mode they are not in any more. They’re connected remotely so if you disconnect the network, they can’t get in.

Reporter: And the only way that they can get back in is to go through the 499 invisible ones again and then do the square thing again and then all you have to do is go back to airplane mode.

Sascha Segan: Bingo!

Reporter: So if I get a message that has that square box on it I should not click it?

Sascha Segan: No you should turn it off.

Reporter: Alright what if I do click it?

Sascha Segan: If you do click it, and you wait a little while clicking the message doesn’t do anything but if you wait a little while the hackers may be able to send additional commands that could do things such as crash your phone, lock up your phone, disconnect your phone from the network.

Reporter: Can they use it as a zombie?

Sascha Segan: Now they are saying that they can, but they have not demonstrated that. The only thing that they’ve actually demonstrated is crashing the phone, but they say they can use it as a zombie but no one has actually seen that happen.

Reporter: And the zombie meaning they can take control of your phone and use it to do something nefarious or whatever they want with a series of computers they have hijacked around the world. So I guess the bottom line is, as creative as this thing is and interesting as the concept is if you see the little square turn your phone off and you’re foiled.

Sascha Segan: Absolutely, and one of the interesting things here is that Apple should fix this patch.

Reporter: They’re Apple and they will.

Sascha Segan: Hopefully yes, but these guys told Apple about it about a month ago and they’re still waiting. Google has already patched their phone. The Google Android phones if you’re on the latest software are not vulnerable.

Reporter: Come on Apple, what’s wrong with Apple? I saw Steve Jobs at the TMZ we know he’s out and about doing things.

Sascha Segan: Of course Apple has no comments on this matter

[via FoxNews.com]

Earlier today I reported on news of the iPhone virus that Charlie Miller and Collin Mulliner presented in the Black Hat conference in New York. I also posted a temporary iPhone virus patch for those who were paranoid about their iPhones getting hacked. I’ve been getting a lot of e-mails from people and just thought I’d make a FAQ post.

iPhone Virus FAQ’s

1. How does the iPhone virus work? It works through SMS. The attacker must know your phone number. All the attacker needs to do is send some characters in an SMS message (multiple SMS messages are sent, but you only see one) and they can control your iPhone.
2. Should I be worried about the iPhone virus? As of right now you don’t need to worry, but if Apple does not release an update soon this can get out of hand. Charlie Miller has revealed how the SMS virus works, so many hackers (more than 4,000) now know how this works. It won’t be long until a software comes out that can easily allow others to send iPhone viruses using the SMS Exploit.
3. Should I be mad at Charlie Miller for releasing this exploit to other hackers? No you shouldn’t. He gave a warning to Apple 6 weeks ago and Apple has done nothing to prevent the exploit.
4. If or once this virus gets big, how do I stay safe? Either turn your iPhone off, put your iPhone in airplane mode, OR use this iPhone virus patch. Apple will most likely have an update out before it gets big.
5. Did Apple release an update yet to patch this vulnerability? Nope, I’ll update you on QuickPWN.com once there is an update.

The iPhone virus is not big yet! Once it does spread I’m sure it will spread quickly by getting peoples’ phone numbers from address books. I just thought I’d make these posts in advance so that once this gets big iPhone users can be prepared.

Want to protect yourself from the iPhone SMS virus? Apple has not released an iPhone 3.1 update yet, and I have no idea when they will be doing so. I could turn off my iPhone and keep it safe, but I’d rather keep it on! I’ve figured out a way to disable the SMS App, but I’m not sure whether or not this will still prevent the virus. Read on below to find out how you can do the same.

How to disable the SMS App

1. Jailbreak your iPhone using either redsn0w or purplera1n
2. Go to Cydia, search for OpenSSH and install it
3. Download an SSH client (WinSCP for Windows users and Cyberduck for Mac)
4. Make sure WiFi is turned on, go to Settings -> WiFi. Select your network and check your iPhone’s IP. SSH in to your iPhone using the iPhone’s IP. Login with the Username: root and Password: alpine.
5. Navigate to the Applications directory
6. Locate the directory named MobileSMS.app. Right-click and click on properties. Where it says Permissions uncheck all the options.
7. Click OK.
8. To test if you did this right, tap the SMS app on your iPhone and it should crash when you launch it!

Once you’ve followed the steps above, the SMS app stops working. I’m keeping my iPhone like this until Apple releases a firmware update, or until Chronic Dev Team is able to release a patch before Apple does. If you want your SMS app back at any time you can fix it by following Step 6 and setting the permissions back to 0755.

Warning: Do not attempt to do this tutorial if you’re not sure how to SSH or change file permissions! Wait for Apple’s firmware update.

I’ll update the site once a firmware update or a real patch is released.

An iPhone hacker, Charlie Miller will release the world’s first iPhone virus today. He discovered an SMS hack 6 weeks ago and reported it to Apple, but Apple has yet to release a patch. Miller and his fellow cybersecurity researcher Collin Mulliner will both explain and reveal their iPhone SMS exploit some time today at the Blackhat cybersecurity conference in Las Vegas.

iPhone SMS hack details

How does the SMS hack work? Firstly, this hack does not requirreleae the victim to download any file. The attacker only needs to know the victim’s phone number. Miller says the attack is enabled by a serious memory corruption in the way the iPhone handles SMS messages. For the attack to work, an attacker must send hundreds of SMS control messages (different from regular SMS messages) and only the initial SMS will be seen. This attack works on both the iPhone and the Andoid. What does the iPhone SMS hack do? This hack can allow the attacker to make calls from your iPhone, steal your data, send text messages, and also spread the attack to other iPhones in your address book.

How to recognize and avoid the iPhone virus

If you get a strange text message containing any square box, even if it’s from a recognized number you may be the victim of the iPhone virus.

You have two choices:

1. Put your iPhone in Airplane mode: Go to Settings -> Airplane Mode and slide the button to Off.
2. Hold down the power button, and slide to turn your iPhone off.

The only thing we can do now is wait for Apple to release a patch. We expect Apple to release the iPhone 3.1 update by September, but hopefully this exploit causes them to release it earlier. iPhone Forensics expert, Jonathan Zdziarski and iPhone hacker p0sixninja from the Chonic Dev Team recently tweeted about the possibility to release their own patch for this vulnerability (only available through a jailbreak). I’m hoping Chronic Dev Team will be able to release a fix for this as this will show Apple that they are wrong about the jailbreaking community. Apple dislikes jailbreaking and is trying to make it illegal. Will the Chronic Dev Team release a patch first or will Apple?  We will keep you updated on this and also post a guide on how to patch once a patch is released! Subscribe to our RSS feed or bookmark this post for updates. Do you think it’s vey irresponsible for Apple to not have released a patch yet? Leave a comment.

Update: An iPhone virus patch has been released!

More links:

• iPhone virus: Fox News
• iPhone SMS Hack FAQs

Update: Apple has released the iPhone 3.0.1 update which should take care of this!