Slashdot Mirror
Apple XcodeGhost Malware More Malicious Than Originally Reported
An anonymous reader writes: Details were scant when Apple confirmed the XcodeGhost malware had infiltrated the iOS App Store. The company didn't say which specific iOS vulnerabilities were exposed and didn't indicate how its iPhone users were affected. However, a Palo Alto Networks security analyst is reporting that XcodeGhost had been used to phish for iCloud passwords, and more specific details are emerging. According to the Networkworld article: "URLs can be sent to the iOS device and opened. This isn't limited to HTTP and FTP URLs, but includes local URLs, such as itunes:// and twitter:// that iOS can be used for inter-app communications. For example, this could be used to force automatic phone calls to premium phone numbers, which can charge up to $1 per minute in some cases. Some iOS password manager apps use the system clipboard to paste passwords into the login dialog. As another example, the XcodeGhost malware can read and write data in the user's clipboard, which would allow it to snatch a password."
Seriously. Xcode is beer as in free, yes it used to cost $5 many years ago because of weird accounting but that was a long time ago. Why would anyone ever download Xcode from the Apple Developer web site or the Mac App Store?
It's actually the opposite. It's much, much less malicious that people say. The source code is available.
For one, it cannot be used for phishing attacks. The UIAlertView is shows has no text input fields and it never attempts to get anything from the dialog other than the integer value of the button that was pressed.
It also cannot get the UDID of the device because it uses -identifierForVendor which is a UUID that is specific to that specific app, so it can't be used to track users. iOS can and will change it.
It can't be used to dial premium services either as iOS always shows a dialog when opening telephone URLs and iOS 9 always shows a dialog when using URLs that open another app. But the fact it can open Twitter so what? It can't do anything with that. It can't control Twitter.
This functionality was actually designed to open the App Store so the user can review/rate the app or to show users similar apps.
It's even significantly less bad than most ad/analytics packages.
It's not, moron. I don't post AC like you do, and I haven't mooed in a long time because I got bored of it.
Feel free to peruse my history - I've mooed many times under my name, yet you keep linking to one example as if it were a slip up you "caught".
The name might be (although it's easy to change it to an arbitrary value in Settings -> General -> About and can't really be considered a unique value), but the identifierForVendor is not. It's only the same for apps with the same bundle ID prefix on a device (apps from the same developer). Different infected apps will have entirely different identifiers.
yawn. This is vaguely interesting in the sense it's novel for using a ken Thompson compiler attack. But it's not an apple problem but a cheapskate developer problem . Morons saved themselves $99 dollars and use unsigned non apple compilers. Dumbasses. Apple just figured out there's dumbasses submitting code. Should be easy to detect non official compilers in the future I would think.
Some drink at the fountain of knowledge. Others just gargle.
It is funny, how people believe that Apple somehow protects them from malware. In reality, all the testing done in their appstore concentrates on verifying that apps do not have a mechanism for payments that bypass Apple. Anything is ok as long as Apple gets their cut.
Citation, hater?
The first word would have been
"Gatekeeper"
Having a UUID on a per Application or Developer basis is in fact better for the attacker. Then they can carefully create a phishing dialog that fits in with the design or behavior of that particular App or package and then associate any information garnered from the user to the particular device and app installation.
Without the altered library inside the actual app, they cannot do this because apps are jailed (or whatever Apple calls it).
Don't you hate those haters who can't be impartial?
Of course all platforms have holes at one point in time. No need to invent some or pray for one just because one's platform of choice is inferior or appears inferior to Apple's or any other for that matter.
For one, I mostly work in the MS world because that's what I specialized in. Today it's rewarding but I have no trouble pointing out it's weaknesses and other OSs strengths. That's what good tech people do. They advise the best tech for the job.
They have the app name, there's no reason to do that with a UUID
But as I mentioned before, there's no phishing support in XcodeGhost as their use of UIAlertView doesn't allow for any text input fields. Even if a different malware tried to phish with a fake dialog, real Apple ID password dialogs on iOS never have a blank entry for the username, it's always part of the dialog text because iOS knows what your Apple ID is. This makes it significantly easier to not be fooled by just taking a cursory glance of the dialog.
The real story is OS X and somehow Apple getting signed code wrong. Maybe some folks had a connection that was super slow and had trouble getting XCode directly from Apple.
However, presumably, the people using XCode are developers. And somehow, they managed to install software that was presumably not properly signed.
Which really makes one worry about the state of mobile development.
On the other hand, the fact that one could build apps, compile them a little bit different and slip them into the app store is a little concerning. Maybe it was the fake XCode author, maybe it was the app developer, but obviously something isn't being sniffed out right during app vetting.