Two things caused this vulnerability: 1. Every iPhone has the same root password by default. Apple never intended for anyone to SSH into their device or see a

Two things caused this vulnerability: 1. Every iPhone has the same root password by default. Apple never intended for anyone to SSH into their device or see a shell at all. 2. Many users install sshd on their jailbroken iPhones without knowing or caring about the implications, and leave it installed and running. There are a few possible solutions to this problem: The maintainer of the sshd package should prompt to change the mobile user's password at install time, disable root SSH access, and install sudo. It would also be a good thing to only allow SSH over WiFi (by default). Maybe a status bar icon to indicate when SSH is enabled should be installed by default, and SSH could not run at startup but require that the user activate it per-boot. (Actually, BigBoss, the developer of the popular dashboard application SBSettings, REMOVED the option to permanently disable SSH access, arguing that SSH is often the only way to fix up an iPhone that won't boot into the GUI and that it should start unless the user disables it for that boot. I disagree with this decision and think that, at the very least, sshd should shut down after the device boots successfully.) The root problem here is that the developer of sshd for the iPhone probably released it to be used as a debugging tool by other developers and hackers. No one has the authority to step in and say "wait, this isn't safe for the general population."