Slashdot Mirror
US Gov't Issues Alert About iOS "Masque Attack" Threat
alphadogg writes Three days after security company FireEye warned of an iPhone/iPad threat dubbed "Masque Attack", the U.S. government has issued a warning of its own about this new risk by malicious third-party apps to Apple iOS devices. US-CERT warned: "This attack works by luring users to install an app from a source other than the iOS App Store or their organizations' provisioning system. In order for the attack to succeed, a user must install an untrusted app, such as one delivered through a phishing link." Revelations of Masque came on the heels of a related exploit (that also threatens Macs) called WireLurker.
Sounds good to me!
Don't you have to jump through all sorts of hoops to even INTENTIONALLY install an app from an alternate source?
Seems like it would be hard to do it unintentionally.
Is their user base so unaware of (gullible to) this possibility that it really warrants a Gov't warning?
Oh wait...
hated almost everything about it
dont use it and will never buy one again
This is almost as dumb as the Weather Channel naming winter storms.
Apple, took a look at it's bottom line, and had to call the government on their BS. This is the retaliation.
Install some others source with your own cert, and it can cause issues.
Apple's issue, if there is one, would be shipping a device with working encryption.
since when does the govt issue virus alerts? My best guess is that NSA is alarmed by uncrackable iphone encryption, so they're doing everything they can to scare people off their iphones and on to something more easy to control like droid or bby
Hi,
This is an Albanian virus. As you know we are not so technical
advanced as in the West. We therefore ask you to delete all your
files on your harddisk manually and send this email to all your
friends.
Thanks for helping us,
The Albanian Hackers
When I saw it many years ago it looked like a good joke
security of a smartphone is not better than that of a PC. What a news.
17779 eligible voters in a district, 17779 'vote' as one. This is Russia.
[amazingkreskin.com] includes wh3re you in a head spiining has ground to a that should be
"install an app from a source other than the iOS App Store"
W: Too many Cooks
B: Too many Cooks
M: Too many Cooks
B: Too many Cooks
W: Too many Cooks
B: Too many Cooks
M: Too many
W: It takes a lot to make a stew
M: When it comes to me and you
W: And him and her and the baby, too
B: Too many Cooks, it's true
M: The saying goes, it'll spoil the broth
W: Honey, I think that's not true
M: Well, maybe too many Cooks will spoil the broth, but they'll fill our hearts with
B: So much, so much lo-o-ove
Too many Cooks
...but it's written for iOS 7 and above. Won't run on my 3Gs.
I feel so left out!
Cleverly disguised as a responsible adult.
So identical to the Android malware, except there's less of it because iPhones are less popular in China?
No. Anyone who wants to can put up an Android app store, or sell an android app with malware in it for side-loading onto the Android phone. Android is *much* more vulnerable, depending on who you trust; trust the wrong person/company, and you're compromised.
To get that enterprise provisioning on your iPhone, you have to give up all other enterprise provisioning and sign up as a device enrolled as an "employee" of that App store, and you do it knowing full well that you're doing it to get pirated apps at a cut rate or free pricetag because you are a criminal.
Users who steal software deserve to get their devices infected with every piece of malware in existence. A lot of software in the Apple Store is free and most of the rest of it is rather inexpensive. I don’t sympathize even a tiny little bit with anyone who tries desperately hard to get something for nothing and then gets royally ripped off.
One valid reason for enterprise side loading is if the App is not offered through iTunes in your region. In many cases, it's not offered worldwide, due to all sorts of regulatory restrictions; this is the same as for music you get from iTunes, where the developer wants market segmentation, or the regulators (government, etc.) in a given area wants segmentation or control.
In those cases, the only way to get the app for your region is to pirate it. For example, in China, as in Russia and the Ukraine, as well as other countries, there are regulations against having strong encryption which does not contain a government back door. In other places, they don't want you to be able to use a particular type of VPN to get around the government firewall which is content based, and media companies don't want you using VPNs to get around regional distribution schemes. As an example, RIAA and MPAA have been trying very hard to get VPNs to be declared illegal, or to declare their actual origin of the their customers, in Australia, the U.K., and elsewhere.
So there are valid political free speech reasons you might want to do this, and there are commercial unavailability reasons you might want to do this. Both of these are internal grey or black market reasons, while being externally viewed as white or grey market, at worst.
Not that that's not what's happening here with the prirate app stores in China that are using voluntary enterprise enrollment in order to install pirate copies of apps on peoples iPhones.
So I call these kinds of exploits stupid user exploits. They only occur because a user specifically has to jump through some obvious hoops to install this kind of
malware. Its not like it seeks out your phone and installs it without a lot of dumb user help. If you don't install apps outside of the official app store you really have nothing to worry about. I know, there is still a lot of very dumb and cheap people out there who fall for such stuff. Just mention "free" and they will click yes to anything. Not reducing the significance of a exploit. But holes are prevalent in any OS and if as a user you purposely jump in the hole and drown. Who's fault is that?
"In order for the attack to succeed, a user must install an untrusted app, such as one delivered through a phishing link."
What is the point about this 'security alert'. If anyone installs an app from some malicious third-party site then of course they are going to get exploited. This is nothing more than social engineering, nothing to see here, moving on. What is this even doing as an article on slashdot?