The Geeks' Den

If you jailbreak your iPhone with anything other than GeoHot’s balckra1n*, then the first thing you ABSOLUTELY MUST DO is change the default filesystem password.

*blackra1n doesn’t install SSH by default, therefore this should not be a problem if you used blackra1n to jailbreak, unless you installed the OpenSSH package from Cydia.

When you jailbreak, the filesystem’s password is set to the common password “alpine.” As people usually don’t bother changing this password after performing a jailbreak, it’s really easy for hackers to get access to any jailbroken iPhone/iPod Touch on a public network.

An Australian guy called Ashley Towns demonstrated this by circulating the first known iPhone worm, known as Ikee, which replaces your lockscreen wallpaper with an image of Rick Astley. Luckily Town’s Rickrolling is benign. He wrote the worm to demonstrate how easy it is to break into jailbroken iPhones.

Note: There is no need to follow this guide if you haven’t jailbroken your iPhone/iPod Touch.

You need:
- Jailbroken iPhone / iPod Touch
- Cydia
- MobileTerminal

Here’s how to change the default SSH password after jailbreaking:

1. Make sure you have Cydia or Rock installed on your jailbroken device. If you don’t already have MobileTerminal installed, launch Cydia or Rock and tap the ‘Search’ tab in the bottom navigation bar.

2. Type ‘MobileTerminal’ in the search field and select the first result. Select ‘Install’ on the top right corner and tap ‘Confirm’ on the next screen. It will now install MobileTerminal on your device. Now, tap on ‘Return to Cydia’ and tap home button.

3. Navigate to the newly installed ‘Terminal’ application and tap to open.

4. In MobileTerminal, type ’su root’ and tap return. It will ask you for a password, enter ‘alpine’ and tap return again.

5. Now, type ‘passwd’ and then tap return. Type in a new password such as ’donthackme’ and tap return. Retype the new password to confirm and then tap return one last time to change the password.

6. Now, your SSH password will be changed and your device will be protected against any future hacks that use SSH to access your device.

I decided today that I need to do a security audit of all of my internet accounts and set new passwords to much stronger ones. So first of all I changed my hotmail account, and then onto my Facebook account. Once I set the second password, in green letters the words:

Kata Laluan Tepat

Appeared below my password. What the heck is this? Apparently it means:

Right Password

In Malaysian, according to http://www.citcat.com/. On Yahoo! Answers others have said it means “Exact Phrase” taken from http://dictionary.bhanot.net/ but I could not find that reference anywhere on that site. So I am going with the Citcat translation. (Anyone who can actually speak Malaysian who can clear this up it would be great to hear from you).

Back to more secure passwords, to make a stronger password I am using some of the below principles in order to make it more difficult for a hacker to get into my accounts:

• a minimum eight characters
• a mix of upper and lower case letters
• at least one numeral, and
• at least one non-alpha numeric character—for example, a symbol.
• Avoid using dictionary or foreign words
• Change your password at least twice a year
• Avoid passwords like your name or business name
• Use different passwords for different systems

While I am not using cryptographic strength or ascii passwords, (I would never be able to remember them), the passwords will hopefully be able to slow most people down.