Slashdot Mirror
US Gov't Issues Alert About iOS "Masque Attack" Threat
alphadogg writes Three days after security company FireEye warned of an iPhone/iPad threat dubbed "Masque Attack", the U.S. government has issued a warning of its own about this new risk by malicious third-party apps to Apple iOS devices. US-CERT warned: "This attack works by luring users to install an app from a source other than the iOS App Store or their organizations' provisioning system. In order for the attack to succeed, a user must install an untrusted app, such as one delivered through a phishing link." Revelations of Masque came on the heels of a related exploit (that also threatens Macs) called WireLurker.
Don't you have to jump through all sorts of hoops to even INTENTIONALLY install an app from an alternate source?
Seems like it would be hard to do it unintentionally.
This is almost as dumb as the Weather Channel naming winter storms.
Apple, took a look at it's bottom line, and had to call the government on their BS. This is the retaliation.
Install some others source with your own cert, and it can cause issues.
Apple's issue, if there is one, would be shipping a device with working encryption.
since when does the govt issue virus alerts? My best guess is that NSA is alarmed by uncrackable iphone encryption, so they're doing everything they can to scare people off their iphones and on to something more easy to control like droid or bby
Hi,
This is an Albanian virus. As you know we are not so technical
advanced as in the West. We therefore ask you to delete all your
files on your harddisk manually and send this email to all your
friends.
Thanks for helping us,
The Albanian Hackers
When I saw it many years ago it looked like a good joke
A large amount of malware on other platforms, mostly Windows, has been due to ignorant users willfully installing malware; bundled toolbars and adware that come with otherwise legit software are probably the best example.
Granted there are zero-day exploits and sometimes exploits in third party software (*cough* adobe *cough*) but the stuff I mentioned a moment ago is most common vector for malware infection.
Now Apple's platform is finally popular enough among average users that it is profitable for the less than honest to target it with such malware, and to make matters worse most Apple users are arguably overconfident in that they are absolutely convinced they are invincible from any kind of malware making them a prime target for such attacks at this point in time. A lot of Apple users, in my personal experience, never ask themselves why there is so much malware in other platforms but rather just repeat what they've been told; that iOS and OS X are immune to such threats.
security of a smartphone is not better than that of a PC. What a news.
17779 eligible voters in a district, 17779 'vote' as one. This is Russia.
"install an app from a source other than the iOS App Store"
Group hug!
Faster! Faster! Faster would be better!
Whereas the Sybian-based ones will get you off.
Gwydion Lashlee-Walton approves.
...but it's written for iOS 7 and above. Won't run on my 3Gs.
I feel so left out!
Cleverly disguised as a responsible adult.
Users who steal software deserve to get their devices infected with every piece of malware in existence. A lot of software in the Apple Store is free and most of the rest of it is rather inexpensive. I don’t sympathize even a tiny little bit with anyone who tries desperately hard to get something for nothing and then gets royally ripped off. Anyone who goes to certain sections of a large city has a good chance of getting mugged. Anyone who goes to certain places on the Internet stands a good chance of getting their devices infected and possibly their bank account emptied. Anyone, whether they use OS X or iOS are in fact TOTALLY IMMUNE if they don’t go places on the Internet where they shouldn’t be in the first place. That goes for Windows users (mostly) also these days.
A sufficiently advanced simulation is indistinguishable from reality.
So identical to the Android malware, except there's less of it because iPhones are less popular in China?
No. Anyone who wants to can put up an Android app store, or sell an android app with malware in it for side-loading onto the Android phone. Android is *much* more vulnerable, depending on who you trust; trust the wrong person/company, and you're compromised.
To get that enterprise provisioning on your iPhone, you have to give up all other enterprise provisioning and sign up as a device enrolled as an "employee" of that App store, and you do it knowing full well that you're doing it to get pirated apps at a cut rate or free pricetag because you are a criminal.
Users who steal software deserve to get their devices infected with every piece of malware in existence. A lot of software in the Apple Store is free and most of the rest of it is rather inexpensive. I don’t sympathize even a tiny little bit with anyone who tries desperately hard to get something for nothing and then gets royally ripped off.
One valid reason for enterprise side loading is if the App is not offered through iTunes in your region. In many cases, it's not offered worldwide, due to all sorts of regulatory restrictions; this is the same as for music you get from iTunes, where the developer wants market segmentation, or the regulators (government, etc.) in a given area wants segmentation or control.
In those cases, the only way to get the app for your region is to pirate it. For example, in China, as in Russia and the Ukraine, as well as other countries, there are regulations against having strong encryption which does not contain a government back door. In other places, they don't want you to be able to use a particular type of VPN to get around the government firewall which is content based, and media companies don't want you using VPNs to get around regional distribution schemes. As an example, RIAA and MPAA have been trying very hard to get VPNs to be declared illegal, or to declare their actual origin of the their customers, in Australia, the U.K., and elsewhere.
So there are valid political free speech reasons you might want to do this, and there are commercial unavailability reasons you might want to do this. Both of these are internal grey or black market reasons, while being externally viewed as white or grey market, at worst.
Not that that's not what's happening here with the prirate app stores in China that are using voluntary enterprise enrollment in order to install pirate copies of apps on peoples iPhones.
Remember that "places where they shouldn't be in the first place" includes sites that serve ads from 3rd party servers.
So I call these kinds of exploits stupid user exploits. They only occur because a user specifically has to jump through some obvious hoops to install this kind of
malware. Its not like it seeks out your phone and installs it without a lot of dumb user help. If you don't install apps outside of the official app store you really have nothing to worry about. I know, there is still a lot of very dumb and cheap people out there who fall for such stuff. Just mention "free" and they will click yes to anything. Not reducing the significance of a exploit. But holes are prevalent in any OS and if as a user you purposely jump in the hole and drown. Who's fault is that?
"In order for the attack to succeed, a user must install an untrusted app, such as one delivered through a phishing link."
What is the point about this 'security alert'. If anyone installs an app from some malicious third-party site then of course they are going to get exploited. This is nothing more than social engineering, nothing to see here, moving on. What is this even doing as an article on slashdot?
hated almost everything about it dont use it and will never buy one again
And this is relevant, how?
Group hug!
If we're talking about "getting off", shouldn't that be "Group Tug"?