Known windows malware propagated via unmounted iPhone

Question

Last week I was told by our security department that my PC (running windows 7) was infected by a trojan and that it needed to be re-imaged. So re-imaged it was! Given the fact that I had been using this PC for a while, visited thousands of web pages and used USB key to

3 days later, the security department notified me again that my PC is infected with malware and that my PC will (again) need to be re-imaged. Since I do not want to reimage my PC every 3 days, I want to figure out the infection vector (assuming it is the same malware)

Possible infection vectors I found:

• Visiting a compromised web site
• Downloading a trojan hidden in legitimate software (I did not download/install more that 3 pieces of software since the reimaging, so that should be easy to find)
• Connecting my iPhone to the USB port of my computer to charge it.

Can the latter be the cause of infection, even if the drive was not mounted? If so, is there a way to check/disinfect it?I found lots of tools for autorun.inf related malware, but these require the media to be mounted as a drive.

Edit: I have not been told what the exact malware was, nor when or how it was detected.

Answer 1

An iPhone doesn't appear as a mass storage device, there's no way to put files on it (other than taking pictures with the iPhone itself) and autorun doesn't work with it.

A malware would need to modify the iPhone's USB stack to make it appear as a standard storage device (like a flash drive) and then put itself on it with an autorun.inf, but even then, Windows 7 and later ask users before running autoruns.

But because Apple restricts app's capabilities so much (each one of them runs in a sandbox, can't access other app's folders nor write to system folders) this is most likely impossible.

Answer 2

This is a rather broad question with a deceptive title. The short answer: HIGHLY unlikely your iPhone is the cause of your machine becoming infected. I will answer WHY I make this statement. The instances of iPhone based malware are pale in comparison to say Android, irrelevant, but true. To explain this, one need understand that in order to sell ANYTHING via Apple's iStore, a developer needs to pay fees, provide EXTENSIVE identification papers (license, state ID, etc).

Even if you were using say an Android it is STILL unlikely your phone is the medium. Further explanation on this: So a virus/malware author makes an Android based piece of malware. You have an APK, maybe some bad java/javascripts, these affect the infected device. The calls the malware will make, are targeted. So Android based malware would NEVER run on say Windows.

Now before someone states: "You're wrong" let me clarify this... Neither Android, nor iPhone based malware WILL RUN on a Windows machine. However, a dropper will. A dropped will/can go out to the internet and get a specific piece of malware of disaffect the infected machine. For example:

Dropper --> hey what kind of machine am I on? --> save to POST --> POST to C&C
C&C --> oh, alright so you need this version ... here download it

Now let's look at the premise of what you asked: "Can someone on my phone, copy itself to a shared drive... Then execute to infect?" Highly unlikely. Most malware authors tend to target that which they are good at. This means, most authors targeting say iPhones, are going to usually stick with targeting iPhones (cocoa, etc., whatever they're familiar with). Unlikely they'd risk detection by 1) exploiting an iPhone, only to shove in Windows based executables which would trigger all sorts of warnings causing detection quicker.

Pretty long answer so far. Now the initial (root case) of the question is: "How am I getting infected." Without knowing WHAT it was you got infected by (e.g. ZBot, Zues, NIMDA, SDBOT, etc.) anything else answered is kind of moot. You can get infected by many things, visiting a site, XSS, USB keys, and so on.

Answer 3

Look at other devices in your network. Several weeks ago I read about a digital tv recorder that was infected via telnet. It's not likely that this has happened, but any device that has internet access is a potential source of malware. If not now, be aware that this is going to happen soon.