| |||||||||||||
What lessons can be learned from the iPhone worms?What lessons can be learned from the iPhone worms?Posted Nov 11, 2009 20:54 UTC (Wed) by mosfet (guest, #45339)In reply to: What lessons can be learned from the iPhone worms? by sourcejedi Parent article: What lessons can be learned from the iPhone worms?
> > should PwnageTool, PurpleRa1n, and the other jailbreak utilities [change the root password] upon installation, either by automatically generating a new password or by prompting the user?
> > Yes, this should be a part of any process which enables remote root login on the iPhone.
No Jailbreak Tool I know installs SSH by default. You have to download and install it afterwards.
> If you can't make it safe automatically, don't distribute it. Definitions of safety may vary, but "enables remote root login using the default password" is not a good one :-).
Indeed. The tool which installs SSH should check for the default password and ask for a new one. But IIRC it is only a .deb package without any frontend interaction.
Also I remember a warning about exactly this problem, when I played around with jailbreaks and ssh on the iPhone.
(Log in to post comments)
What lessons can be learned from the iPhone worms? Posted Nov 11, 2009 22:23 UTC (Wed) by sourcejedi (guest, #45153) [Link]
That's interesting. I thought PermitRootLogin was false by default, but I was wrong - both for upstream and the current Debian package. That makes it much more of a grey area.
|
|||||||||||||