iOS Trojan Targets Hong Kong Protestors

First time accepted submitter Kexel writes Security researchers have claimed to discover the first Apple iOS Trojan attack in a move to thwart the communications of pro-democracy Hong Kong activists. From the article: "The malicious software, known as Xsser, is capable of stealing text messages, photos, call logs, passwords and other data from Apple mobile devices, researchers with Lacoon Mobile Security said on Tuesday. They uncovered the spyware while investigating similar malware for Google Inc's Android operating system last week that also targeted Hong Kong protesters. Anonymous attackers spread the Android spyware via WhatsApp, sending malicious links to download the program, according to Lacoon. It is unclear how iOS devices get infected with Xsser, which is not disguised as an app."

Comments

Advanced? Requires a Jailbreak & manual instal

[mTor]

Here's the actual analysis of malware:

https://www.lacoon.com/lacoon-...

The iOS device needs to be jailbroken in order to be infected. Then with Cydia installed, the repository would be need to be added and then the package could be installed. All thatâ(TM)s known is that both the iOS and Android attacks share a CnC server.

Re:iOS Attack Vector?

[tlhIngan]

So, the question begging to be asked is whether jailbreaking phones in China by the owner is a common occurrence or if the phones are sold "pre-jailbroken" by a larger agency and able to download and install these hacks at will?

Probably a mix of both, because the #1 reason to jailbreak these days seems to be... pirating software. I mean, the iOS 7.12 jailbreak was done by a bunch of Chinese people to promote... their Chinese app store. Which happens to conveniently be filled with pirated apps. (It was one of the things that led to the original iOS7 exploit to be questioned).

So effectively the users jailbreak to get "free apps" from the Chinese app store that also happens to install malware along with it.

I'm guessing the Chinese store must have a lot of pirated apps, because piracy on iOS is just at a lower level - at least on Android there are entire "daily packs" that contain new and freshly updated paid apps on your favorite torrent site (which can be RSS fed to your torrent client). iOS apps ... not so much. Maybe a fraction and not as convenient to get.

xsser

[koan]

https://www.lacoon.com/lacoon-...

"Cross-Platform attacks that target both iOS and Android devices are rare, and indicate that this may be conducted by a very large organization or nation state. The fact that this attack is being used against protesters and is being executed by Chinese-speaking attackers suggests it’s first iOS trojan linked to Chinese government cyber activity."

Re:Advanced? Requires a Jailbreak & manual ins

[Noah Haders]

well, considering that over 50% of all iOS devices are running iOS 8, and no jailbreak exists for this OS, i think there are a lot of people who hasnt jailbroken their phones. anecdotally, I don't know anybody that has done this. oh wait I know one guy but he was a bit of a wanker.