Slashdot Mirror
Apple XcodeGhost Malware More Malicious Than Originally Reported
An anonymous reader writes: Details were scant when Apple confirmed the XcodeGhost malware had infiltrated the iOS App Store. The company didn't say which specific iOS vulnerabilities were exposed and didn't indicate how its iPhone users were affected. However, a Palo Alto Networks security analyst is reporting that XcodeGhost had been used to phish for iCloud passwords, and more specific details are emerging. According to the Networkworld article: "URLs can be sent to the iOS device and opened. This isn't limited to HTTP and FTP URLs, but includes local URLs, such as itunes:// and twitter:// that iOS can be used for inter-app communications. For example, this could be used to force automatic phone calls to premium phone numbers, which can charge up to $1 per minute in some cases. Some iOS password manager apps use the system clipboard to paste passwords into the login dialog. As another example, the XcodeGhost malware can read and write data in the user's clipboard, which would allow it to snatch a password."
Seriously. Xcode is beer as in free, yes it used to cost $5 many years ago because of weird accounting but that was a long time ago. Why would anyone ever download Xcode from the Apple Developer web site or the Mac App Store?
It's actually the opposite. It's much, much less malicious that people say. The source code is available.
For one, it cannot be used for phishing attacks. The UIAlertView is shows has no text input fields and it never attempts to get anything from the dialog other than the integer value of the button that was pressed.
It also cannot get the UDID of the device because it uses -identifierForVendor which is a UUID that is specific to that specific app, so it can't be used to track users. iOS can and will change it.
It can't be used to dial premium services either as iOS always shows a dialog when opening telephone URLs and iOS 9 always shows a dialog when using URLs that open another app. But the fact it can open Twitter so what? It can't do anything with that. It can't control Twitter.
This functionality was actually designed to open the App Store so the user can review/rate the app or to show users similar apps.
It's even significantly less bad than most ad/analytics packages.
Come on sexconker, we know it's you.
The use of [[UIDevice currentDevice] name] and [[UIDevice currentDevice] identifierForVendor] (as well as several other pieces of information including App Name, App Version, OS Version, Language, Device Type, Location, etc.) are enough to not only create a generated Unique ID for each device to track on the analytic side but also all of the Apps infected by the malicious code.
The people tracking the smartphones do not need the actual local device UUID if they can get enough information to generate their own.
I agree with other's calls to mod parent down. Does not seem to understand the fact the list of information being digested by the hack and the access being granted is enough to be used for malicious tracking and phishing.
It's not, moron. I don't post AC like you do, and I haven't mooed in a long time because I got bored of it.
Feel free to peruse my history - I've mooed many times under my name, yet you keep linking to one example as if it were a slip up you "caught".
yawn. This is vaguely interesting in the sense it's novel for using a ken Thompson compiler attack. But it's not an apple problem but a cheapskate developer problem . Morons saved themselves $99 dollars and use unsigned non apple compilers. Dumbasses. Apple just figured out there's dumbasses submitting code. Should be easy to detect non official compilers in the future I would think.
Some drink at the fountain of knowledge. Others just gargle.
Sounds legit.
Probably a testament to iOS security (The walled garden keeps the bad guys out too) that the malware goons are resorting to attacking the developer toolchain to get a foothold.
Also illustrates what are probably poor developer relations with developers in China, as they seemed to prefer to get their xcode from dodgy ad-hoc local repositories instead of official ones.
Wonder if this will cause apple to look in to some sort of toochain security/authentication/signing. - Only letting apps in if the toolchain is verified at compile time. Sure there would be ways around that but it would help mitigate this sort of watering hole attack.
It is funny, how people believe that Apple somehow protects them from malware. In reality, all the testing done in their appstore concentrates on verifying that apps do not have a mechanism for payments that bypass Apple. Anything is ok as long as Apple gets their cut.
Citation, hater?
The first word would have been
"Gatekeeper"
Don't you hate those haters who can't be impartial?
Of course all platforms have holes at one point in time. No need to invent some or pray for one just because one's platform of choice is inferior or appears inferior to Apple's or any other for that matter.
For one, I mostly work in the MS world because that's what I specialized in. Today it's rewarding but I have no trouble pointing out it's weaknesses and other OSs strengths. That's what good tech people do. They advise the best tech for the job.
The real story is OS X and somehow Apple getting signed code wrong. Maybe some folks had a connection that was super slow and had trouble getting XCode directly from Apple.
However, presumably, the people using XCode are developers. And somehow, they managed to install software that was presumably not properly signed.
Which really makes one worry about the state of mobile development.
On the other hand, the fact that one could build apps, compile them a little bit different and slip them into the app store is a little concerning. Maybe it was the fake XCode author, maybe it was the app developer, but obviously something isn't being sniffed out right during app vetting.
Yes it could. It could be Android.