Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 1 down vote favorite
1

I have a jailbroken iPhone. Recently, I have realized that its battery usage is abysmal. Suspecting that it has something to do with the radio, I downloaded Data Counter from Cydia to check real-time data usage and found that even with push notifications off and exchange set to manual, there is a persistent 0.06kb/s of data transfer. So I hooked the iPhone to a WiFi network and captured packets originating from its IP address using Wireshark under promiscuous mode.

I get A LOT of these:

No.: 1907  
Time: 252.345269  
Source: 192.168.2.3  
Destination: 10.236.199.xx  
Protocol: TCP  
Info: 49833 > ssh [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=2 TSV=994197017 TSER=0 SACK_PERM=1

Where 10.236.199.xx is the destination IP and xx goes from 0 to 249, then goes back to 0.

If it helps, my cellular data IP address is 10.236.199.213 and my cellular provider is SingTel (Singapore).

I believe when I am on 3G, these packets are keeping the radio transmitter from powering down and thus draining the battery severely.

Which app is causing all these packets and how can I stop it from going on?

share|improve this question
1  
It would appear the rooted phone has been rerooted and something is trying to establish a connection to any other phone on the 255.255.255.0 subnet that willl listen to it, so it can root those phones too. This is in theory, but that's the behavior. It's looking to establish an outbound connection. Without a full wipe and careful rescan it's going to be hard to determine what is causing this, unless every single app can be enumerated that has been installed. Then peer review can help narrow it down. – jcolebrand Dec 29 '10 at 17:08
If it's practical, I'd be tempted to set up an ssh honeypot and see what its attack looks like -- this might be more informative than trying to find/remove the running code on the iPhone itself. – Gordon Davisson Dec 29 '10 at 19:52
How can I get the computer to bind to an IP address within the 10.236.199.xx range? (my NAT router uses 192.168.2.xx). – Louie Tan Dec 30 '10 at 8:31
@Gordon ~ Doesn't that require two phones on that subnet? ~ @Louie You can't. It's on the mobile network. Best you could do is try and find an engineer for the company who's high enough to be able to do that and low enough that his first response will be "cool let's fight those bastards" and not "eff you, reformat the phone" or even worse, asking you to let him see it, then him reformatting it by force before you realize it. In other words, you can't. – jcolebrand Dec 30 '10 at 14:35
I think it should be possible to fake a computer being in the 10.236.199.x range, if you have/can install the route command on the iPhone (maybe available from telesphoreo.org, though I don't know how up-to-date that is). On the Mac, run sudo ifconfig lo0 alias 10.236.199.100 netmask 255.255.255.255 then sudo route add -host 10.236.199.213 192.168.2.3. On the iPhone, run sudo route add -host 10.236.199.100 192.168.2.theMac'sIP. – Gordon Davisson Dec 31 '10 at 1:03
show 3 more comments

1 Answer

up vote 4 down vote

You jailbroke (is that a word? jailbreaked?) it, thereby opening the door to any application doing anything with your hardware. And now it appears that some application is doing something with your hardware. Your phone is compromised and is now trying to compromise other devices on its netblock. You're carrying a virus infection vector in your pocket.

I recommend a full restore absolutely ASAP, and I recommend really thinking about whether jailbreaking is for you.

I'm not anti-jailbreak. I just think people aren't aware of the full repercussions when they do it. Apple's not just being arbitrary in only allowing vetted software onto the devices. It's not JUST a business move on their part. It also protects users from exactly what has happened to you.

share|improve this answer
4  
+1 totally agree with this. I don't mind jailbreaking (although I don't), but this is one of the reasons why they don't want you too. Though, hopefully (unless its trying to expose a flaw in iOS itself) it is only restricted to other jailbroken devices. – jmlumpkin Dec 30 '10 at 13:42
Actually I've restored and re-jailbroke my phone about 3 times this year because of battery problems. Every time I start afresh it's okay for a while but after a few weeks something goes wrong, though this is the only time I've actually tried sniffing data. If you're wondering "Hasn't this idiot learnt anything after 3 attempts to restore his iPhone?" I can only say that I've gotten too used to all of the functionality only available after jailbreaking (PdaNet, Intelliscreen, biteSMS), and the fact that I can only copy the restricted mp3s out of AMPed when the phone is jailbroken! – Louie Tan Dec 30 '10 at 14:11
Then why don't you just buy a fracking android? Seriously. – jcolebrand Dec 30 '10 at 14:36
THAT'S WHAT I INTEND TO DO AS SOON AS MY CONTRACT IS UP FOR RENEWAL, WHICH IS IN ANOTHER YEAR!! – Louie Tan Dec 30 '10 at 15:05
1  
@Louie: Restore. Re-jailbreak if you must. Then load the apps you really want, and monitor battery life. If good, load some more and monitor battery life. Keep doing that until you have a good idea which of a set of apps are abusing your phone. Then restore and re-jailbreak again, this time with some idea as to what apps to avoid. If you keep doing the same thing, you will likely keep getting the same results. – David Thornley Dec 31 '10 at 2:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.