Is it realistic? Let's go beyond "plugged in to a computer."
This depends on a several factors:
- Are you running unpatched software? Seriously?
- Is there a remotely-accessible service running on a specific port that's exposed to
0.0.0.0/0, or any IP range that would also include the attacker's IP?
- Is it client-side, which would require an attacker to send you a URL, or get you to connect with
Client X to
Server A to execute the payload in your client?
Is there publicly-available exploit code, such as a metasploit module, or something they can find on sites such as exploit-db, or are they able to buy some cheap (haha) exploits on the dark net?
set RHOSTS 192.168.13.37 [assume this is your IP]
HAHAHAHAHAHA I'M HACKING THE INTERNET
- Do you have some kind of service misconfiguration you've set up that that allows remote access with anonymous, default or weak credentials to ftp, ssh, telnet, etc?
Answer the questions above
If your answer is yes to 1, 2, and 4, then yes, they can very easily do that.
If your answer is yes to to 1, 3, and 4, then yes, they can do that provided you connect to their Client-side-exploiting service/server/whatever.
If your answer is yes to 5, then yes, but it depends.
- If you're running an FTP server with default/weak/anonymous credentials, and a WWW server on your iPhone (why the hell would you do that? You've jailbroken, so none of this would surprise me), then they could get a privileged or low-privileged shell access to your iPhone. If it's privileged (again, why would you run any of this as root/etc?), then very easily. If it's not, then they would need a local privilege escalation exploit of some kind in order to get access.
- If you're running an ssh or telnet service with default/easy root/admin credentials, prepare your diddly ports.
It's very realistic, so you should start auditing your stuff.
Connect your iPhone to the home network via WiFi, and use nmap on another system and see what ports are open on your phone. See what's being exposed via TCP and UDP (
-sU), and see if there exploits available for the detected services.
Remember, when you connect your phone to any network, an attacker squatting on said network can scan and perform attacks against your devices. This could be airport WiFi, restaurant WiFi, your home network, or even the entire internet if you're not behind some form of NAT.