This is a nice read. This worm is named iBotnet.A. It explains the latest worm, which is quite a bit more malicious than the Rickroll worm that made the news two weeks ago.
Note that both of these worms aren't really exploiting holes in the underlying code. They take advantage of the ignorance of the user. To elaborage, both take advantage of the fact that jailbreakers need to install SSH software onto the phone. Jailbreakers tend to forget that the default password is public and known to the world. The smart moves would be to, 1) change the password to something else; 2) remove the SSH server after jailbreaking the phone; 3) if you still need the SSH server, use SSH key authentication. These seem like no-brainers to me but these are not apparent to most jailbreaker, since they usually don't have security in mind when installing this unauthorized firmware.
This worm is a bit humorous, also:
After it finds a vulnerable phone, iBotnet.A changes the root password to "ohshit"
Now that's funny!
