Slashdot Mirror
iOS Trojan Targets Hong Kong Protestors
First time accepted submitter Kexel writes Security researchers have claimed to discover the first Apple iOS Trojan attack in a move to thwart the communications of pro-democracy Hong Kong activists. From the article: "The malicious software, known as Xsser, is capable of stealing text messages, photos, call logs, passwords and other data from Apple mobile devices, researchers with Lacoon Mobile Security said on Tuesday. They uncovered the spyware while investigating similar malware for Google Inc's Android operating system last week that also targeted Hong Kong protesters. Anonymous attackers spread the Android spyware via WhatsApp, sending malicious links to download the program, according to Lacoon. It is unclear how iOS devices get infected with Xsser, which is not disguised as an app."
1. You grab your protestor-beating-nightstick.
2. You walk down to the phone distributor's HQ
3. You say: "You know that software update system you built for your phones? Let us borrow it for a while"
4. If you run into any problems, gesture vaguely at the nightstick from step 1.
Problem solved.
Here's the actual analysis of malware:
https://www.lacoon.com/lacoon-...
The biggest question is, jailbreak or no jailbreak? It's been known for some time that jailbroken phones are huge targets for spyware/malware. But to-date these wares have been ineffective on non-jailbroken phones. I guess we'll see when/if the answer comes to light, otherwise it's a lot of FUD.
+1000 relevant. when any iOS malware is reported, the first question is, "does it require jailbreaking". To my knowledge all of the trojan/spyware/NSAware/etc require a jailbroken iphone.
sudo apt-get install malware
Easy-peasy.
The Android attack vector is pretty clear. Oddly, they don't know how it spreads to iOS devices. If it's not spread as an malicious, sandboxed app, then how does it get on an iPhone?
How about:
a) Phone was jailbroken.
b) Phone had a modified iOS installed.
c) Some vulnerability exists in one of the built in apps that allows malicious software to be installed outside of the confines of the sandbox.
Given it's happening in China during the protests and with a large iOS device blackmarket, I'm betting on (b) followed by (a) with a very slight chance of (c) and that this malware won't be seen in the rest of world anytime soon.
wrong, try again.
--
If you are one of the mobile phone developers who think the security of mobile phone operating systems is in any way acceptable, you will have blood on your hands.
oh by the way, the exploit to jailbreak ios7 was developed by a previously-unknown Chinese haX0r group. Just putting that out there.
Is this a story about iOS malware? Then you should require the answer to this question:
1. DOES IT REQUIRE JAILBREAK?
The only *interesting* iOS malware story is one that does not require jailbreak. I'm not aware of any; there may be some that use known or unknown exploits, but in this case the malware requires the user to have a jailbroken phone. That's not news or "stuff that matters".
Sincerely,
Slashdot Readers
Natural != (nontoxic || beneficial)
Sounds to me like that had this ready to go, even before the protests. I'd imagine that the percentage of jailbroken iOS devices in China markedly outstrips those in the western world, given the political climate and sandboxed internet there. It seems that the government was both aware of the devices and had the gun cocked and ready to fire.
Apparently the malware authors have a ready-to-go development environment running. I'd love to see it. Templates, libraries, modules, drivers...
Until someone use one of those remote vulnerabilities that were used previously to jailbreak phones for malware (I remember one that did the jailbreak with just visiting a web page). We are talking about China here, so if this is some kind of government sponsored attack, they probably already have unreported security bugs at their disposal. It is true that iPhone security has being enhanced with every release, but at the same time code size has increased, so It must be something in ther to do more damage with enough resources
Looks like it SHOULD be labelled as a CYDIA Trojan
IOS 8.0.1 will disrupt cellular communications on an iPhone without the need to root the phone.
It's not a bug, it is a feature.
Fight Spammers!
Apple designs them this way, so that nation states can access therm, they get favored status for this.
The otherr option for you fanbois is that Apple is simply incompetent.
"If any question why we died, Tell them because our fathers lied."
https://www.lacoon.com/lacoon-...
"Cross-Platform attacks that target both iOS and Android devices are rare, and indicate that this may be conducted by a very large organization or nation state. The fact that this attack is being used against protesters and is being executed by Chinese-speaking attackers suggests it’s first iOS trojan linked to Chinese government cyber activity."
"If any question why we died, Tell them because our fathers lied."
+1000 relevant. when any iOS malware is reported, the first question is, "does it require jailbreaking". To my knowledge all of the trojan/spyware/NSAware/etc require a jailbroken iphone.
That's great, but seriously, who doesn't jailbreak their iphone? The security of the walled garden is fairly theoretical since there is so much incentive to disable it.
It is a bit like saying that some website can't steal your personal info unless you click through that warning that shows up the first time you use Firefox on a webpage with a non-SSL form.
Perhaps stories like this will make clear what the costs of disabling code signing really are, to be weighed against the incentive to disable it ...
I'm pretty normal, apparently, and my phone is not jailbroken. I think it's less common than you think.
I'm considering jailbreaking my iPhone to be able to run git. Otherwise... I just haven't had the need.
Android's a different story. You need to root your phone so that you can firewall your flashlight app.
Code for Pangu jailbreak was stolen from a well-known iOS hacker and security researcher i0n1c/Stefan Esser:
https://twitter.com/i0n1c/stat...
well, considering that over 50% of all iOS devices are running iOS 8, and no jailbreak exists for this OS, i think there are a lot of people who hasnt jailbroken their phones. anecdotally, I don't know anybody that has done this. oh wait I know one guy but he was a bit of a wanker.
It's been discovered (in the scientific sense of that word) Xsser effects only *Jailbroken* iOS devices -- which is a major relief for those of us who understand how code signing works!
http://threatpost.com/xsser-trojan-spies-on-jailbroken-ios-devices
Generally the number of jailbroken iOS devices has hovered around 10%.
Not too many people do jailbreak because iOS is pretty much good enough, and each revision just adds less and less reason to do so. Sure there's always going to be folks who jailbreak to get it so they can customize every single thing like an Android phone, but for the most part, most user's reasons for jailbreaking disappear each new iOS revision.
(Remember, there are a LOT of iOS devices out there, so when a new jailbreak claims "1 million devices were jailbroken", that pales in comparison to numbers like 50+M iPhone5S's were sold or 10M iPhone6/6+ were sold. ).
About the only reason people consistently jailbreak is... pirated apps, and even those have a non-jailbreak workaround involving cracked apps and enterprise signing certificates (which generally last only a short time because Apple invalidates them quickly). Even then the iOS piracy scene is tiny compared to Android. If you want apps for free, Android's really where it's at. It's far easier to find an app cracked for Android than it is for iOS. Usually because on Android what they do is they buy it, then refund it.
You ignored the second part of the requirement: The malware requires a jailbroken phone AND THEN it requires you to _install the malware_.
In other news, if you disable your computer's anti-virus software and install a virus you will...have a virus. Shocking, I know.
I think that one was a vulnerability in iOS 4.1. Since then there have been a variety of tethered and untethered jailbreaks. All have required directly interacting with the physical device, and all these holes have been plugged up quickly once the vulnerability is released.
'Security researchers have claimed to discover the first Apple iOS Trojan attack .. It is unclear how iOS devices get infected with Xsser, which is not disguised as an app."'
Stefen Esser.
And the trojan is called Xsser?
Connection?
Really?
I jauibroke my first iDevice, but pretty quickly realized it was a pointless exercise, and have had no interest in doing it again.
The problem with jailbreaking an iDevice is that it mostly gives you the power to do pointless things in a shoddy way (like you can download an app icon theme, that changes how the icons for the apps the creator was aware of look, thereby ensuring that something like 70% of your apps look "steampunky" and the others look completely out of place.) Initially there were some useful things like tethering, or adding folders, but by and large those have become core iOS features since then.
If I wanted that I'd have gotten an android phone. The whole point of an iPhone is you're not supposed to have to care about crap like what keyboard theme you have and whether that "kitten of the day" widget is also a key logger, and can instead get on with using your phone.
http://arstechnica.com/security/2014/06/surprise-ios-7-1-jailbreak-for-most-iphones-and-ipads-uses-year-old-flaw/?comments=1
Code for Pangu jailbreak was stolen from a well-known iOS hacker and security researcher i0n1c/Stefan Esser:
https://twitter.com/i0n1c/stat...
WHAT? Say it ain't so!
Douchebag Noah Haders caught talking out of his ass again?
I guess the supposed previously unknown Chinese haX0r group is still unknown.
Beware that many jailbreakers also install SSH on their devices. SSH comes with a default password "alpine" for the two users present on an iOS device (root and mobile). Both of them obviously need to be changed.
If a jailbreaker forgets to change both default passwords SSH access is wide open and malware can easily be installed from outside.
GCHQ claims to be able to access any iPhone, jailbroken or not. It stands to reason that it is possible, since clearly the jailbreak exploit itself is cable of exploiting a non-jailbroken phone. Other malware could discover and use the same weaknesses.
Remember when you could jailbreak just by visiting a website?
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
yes that was for ipad2 and iphone4. the diff between apple and goog is that less than 10% of ios devices are using anything before ios7, and less than 2% using anything before ios6. meanwhile, the vast majority of goog users are stuck on old OS before 4.0 cuz they're no longer supported.
Pro tip: Circumventing system-wide code signing is a detriment to device security...