"This is how the story goes: you receive an email in which you find out that you might get your hands on a new version of an iPhone unlocking application which basically allows you to overcome vendor set network restrictions," said Iona Jelea, a security researcher with BitDefender. "All you have to do is... yes, click a link that will take you to the webpage on which the technical wonder awaits you".
Victims follow the link, download an executable file, and are then instructed to connect their iPhone to their PC via a USB cable, before running it. "Once downloaded and run, the executable opens up a way for a Trojan to fester on your PC," Jelea said.
The software is identified by BitDefender as Trojan.BAT.AACL. It comes as a Windows batch file packed alongside the application that is supposed to jailbreak an iPhone. It changes the preferred DNS server address for various websites on the victim's computer (presumably using the Windows hosts file) to a specific IP address controlled by the malware creators. This IP address then intercepts the victims' communications with selected websites.
At the Pwn2Own contest at the CanSecWest security conference in Vancouver last month, security researchers from the University of Luxembourg hacked an iPhone by chaining together pieces of code. They were able to execute arbitrary code on an iPhone when a user visited a malicious website, and demonstrated an attack that stole the SMS database from the phone. Other attack payloads were easily possible, the pair said. The details of the attack are proprietary, owned by intrusion prevention company TippingPoint, which sponsors the contest. It has disclosed the bug to Apple, but will keep details under wraps until Apple plugs the hole.