Slashdot Mirror
Advertising Malware Affects Non-Jailbroken iOS Devices
An anonymous reader writes: Malware called YiSpecter is infecting iOS devices belonging to Chinese and Taiwanese users, and is the first piece of malware that successfully targets both jailbroken and non-jailbroken devices, Palo Alto Networks researchers warn. What's more, the techniques it uses for hiding are making it difficult to squash the infection. YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so that they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution. Through this kind of distribution, an iOS app can bypass Apple's strict code review procedures and can invoke iOS private APIs to perform sensitive operations.
Let the griping begin. Queue the fanboys from both sides.
So this doesn't work for apps downloaded from the iOS app store. For the vulnerability to work, you first have to download and install an Enterprise certificate, then you have to download and install an infected app from a specific third party website signed with that Enterprise certificate. This isn't really a vulnerability, this is the specific application path for installing custom enterprise apps at your private business. Don't go around installing unknown junk and you'll be fine.
YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so that they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution.
So Apple should revoke the certificate. Why is this a problem? What makes this newsworthy? What am I missing?
It should surprise nobody that malware makers find security holes. Apple is no exception. But the entire point of certificates is that they can be revoked in the event there is a problem. Revoke the certificate which should then disable the app. If it doesn't work this way then something is wrong and the certificate is pointless.
IOS is for Sheeps.You are all sheeps. sheeps say Mehhhhh. Mehhhhh! Mehhhhh sheeps Mehhhhhh!!!!Mehhhh say the sheeps. YOU NON-JAILBROKEN SHEEPS!!!
You're praying to me wrong --- Steve J
Seven puppies were harmed during the making of this post.
Those people better all go and rush to buy a Windows anti malware program from some virus signature company who uses the same signature scanner as the majority of malware signature scanning companies. Selling sand to Arabs. Thank goodness that these signature scanning companies don't sell incontinent pads or else half of them would be pre-moist with shit stains.
Looks like we might have a Ferguson chimpout right in Cupertino. Apple had better comply with All Sharptons demands for more social justice and diversity in the ranks. Let's also squander billions of dollars on STEM and "everyone should code" crapola in the inner city where kids are more interested in dealing drugs and spray painting walls. Yes we need more do gooder liberal SJW bull shit.
You're new here, aren't you?
Check my userid. Some have been here longer but unless you are being ironic the answer is no I'm not new here.
You know how many threads there are defending / promoting the notion that i devices are impervious to malware / viruses?
Yes I am aware. Yes their arguments are generally idiotic.
Also, it's possible once the malware gets a hold of the system, it might block actions.
If that it is true then that is a huge flaw in the system which Apple needs to correct as soon as possible. I understand that such a scenario is possible but I also understand that it is correctable. If some software needs to break to improve security then so be it.
It's an enterprise certificate, so those companies want more control over what goes in and out -- they don't want mission critical software to be suddenly removed because someone at APL bungled something.
Doesn't matter. If there is a security flaw where a certificate has been compromised then the only correct response it revoke the certificate. Yes this could be highly inconvenient but the danger of not revoking the certificate and disabling the vulnerability is worse. A certificate that isn't revoked when necessary is worse than useless. If the danger does not justify a certificate then what is the point of issuing one in the first place?
Every now and then, I read a comment from someone about how Apple must "hate" the jailbreakers, because they keep closing off the flaws which make jailbreaks possible. The reality -- as effectively demonstrated in this instance -- is that the flaws which allow jailbreaks also just happen to open your phone up to malware. Apple is far more concerned with what a malicious entity might do to their customer base through these flaws, then with what the jailbreakers are doing to their own phones. Would, that more people understood this.
I checked the "Ads Disabled" box here at /.
...has just been REVOKED. Seriously, they need to revoke those certs ASAP.
And the exploit the malware used was fixed in iOS 8.4 or later.
In other words, Apple products are not well designed for use in the enterprise market.
Actually if you have a somewhat recent update, iOS 8.4 or 9.0 then the exploit is fixed. So enterprise users who get patches are just fine.
Except it doesn't. See, this just "infects jail broken and non jail broken" devices which basically mean every single I device out there, which is tens or hundreds of millions of devices.
Sorry, you fail reading comprehension. Re-read and note that the user has to intentionally manually install certain enterprise certificates and intentionally manually install a malware infected app. Now add to this that the user has had to also decline the last two major iOS updates, 8.4 and 9.0. Hardly any iOS users are at risk.
See subject: Preempting infestation by stopping you from getting it in the 1st place:You can't be burned if you can't touch it & neither it you & most threats today originate online so I built this:
APK Hosts File Engine 9.0++ SR-2 32/64-bit:
http://start64.com/index.php?o...
---
Which unlike OTHER "so-called 'security-solutions'" it SPEEDS YOU UP 2 ways:
1.) Adblocking - A major source of infection by malware ala -> http://apple.slashdot.org/comm... & -> http://apple.slashdot.org/comm... which also gains you tremendous speed back (ads = up to 50% of major websites' pages & blocking ads gets it back)
&
2.) Hardcoding favorite websites @ the TOP of a hosts file - that's where you spend MOST OF YOUR TIME ONLINE, like 95++% most likely!
(Which aids reliability vs. DNS redirect poisoning & being downed which ALSO ADDS SPEED since you do resolutions locally from RAM vs. calling out to remote more-than-potentially bushwhacked slower DNS servers).
APK
P.S.=> It gets its data from 10 reputable sources in the security community vs. malicious sites, phish/spam, ads, trackers, etc. which are update frequently!
You can choose to:
1.) Use "the latest/greatest data" (smaller dataset & more current, like antivirus "normal settings" work)
OR
2.) Build up your custom hosts file data up for PROTECTION LONG-TERM by accumulating it daily adding to previous blocking data vs. threats online (almost like antivirus does "heuristic 'high-power' scanning" when set to do so, with larger & older than most current datasets in use for scanning vs. threats)...
It works for more speed, security, reliability + anonymity online!
(... & does FAR MORE for FAR LESS resource consumption from a SINGLE FILE YOU ALREADY NATIVELY HAVE BUILT-IN to your OS & IP stack (it operates in kernelmode, far faster than usermode addons or other solutions there + is 1st resolver queried for speed, operating long before browser addons do) than ANY single browser addon by far)
... apk