iPhone firmware 1.1.3 prep Is a Trojan Horse, It Is In The Wild

Information about this Trojan were first posted on Saturday on the iPhone modification forum ModMyiFone.com. When installed, the Trojan appeared to do nothing more than display the word "shoes". But if one tries to uninstall the package, it messes up certain programs in var/root/bin/ directory.

Apps that get messed up include the following;

• Erica's Utilities
• OpenSSH
• Launcher
• Doom

The Trojan, known as "iPhone firmware 1.1.3 prep", or "113 prep", is the first to be seen in the wild, according to Symantec researcher Orla Cox.

"This is technically the first Trojan horse seen for the iPhone; however, it does appear to be more of a prank than an actual threat," Cox wrote in a blog post. "The impact of uninstalling the 'Trojan' would appear to be an unintended side effect."

ModMyiFone.com carried the following Update:

After STE (most of the .xml was taken directly from STE packaging but used in a malicious manner) called the number listed on the domain registration it turns out the person who is responsible is actually an 11 year old. STE has talked to his father and has been assured that the site will be removed tonight.

Both Symantec and F-Secure warned that users should be cautious when installing third-party iPhone applications. Apple itself warned users in September last year that its own updates could break unlocked iPhones running unofficial iPhone software.

tag: iPhone, iPhone Trojan, Symantec, F-Secure, ModMyiFone, STE packaging, iPhone firmware 1.1.3 prep, 1.1.3 prep, 113 prep