Slashdot Mirror
Hacking Campaign Targets iPhone Users With Data-Stealing, Location-Tracking Malware (zdnet.com)
ZDNet reports of a new mobile malware campaign that is "gaining access to iPhones by tricking users to download an open-source mobile device management (MDM) software package." From the report: Once in control, the unidentified hackers can steal various forms of sensitive information from infected devices, including the phone number, serial number, location, contact details, user's photos, SMS, and Telegram and WhatsApp chat messages. Thirteen users -- all in India -- have been been compromised in the attacks, which have been detailed by Cisco Talos. Those infected use a range of iPhone models and are running iOS versions ranging from 10.2.1 to 11.2.6. The campaign has been active since August 2015. The attackers take control by using the MDM package, which can give attackers complete control of the device and the ability to install fake versions of real apps.
Two different MDM services are used in the campaign, enabling system-level control of multiple devices from one location and the ability to install, remove and exfiltrate data from apps. One method of stealing data comes via malicious versions of messaging services like Telegram and WhatsApp being pushed onto the compromised device via fake updates. The apps look legitimate to the user, but malicious code sends information -- including messages, photos and contacts -- to a central command and control server. Deploying these apps requires a side-loading injection technique, which allows for the ability to ask for additional permissions, execute code and steal information from the original application.
Two different MDM services are used in the campaign, enabling system-level control of multiple devices from one location and the ability to install, remove and exfiltrate data from apps. One method of stealing data comes via malicious versions of messaging services like Telegram and WhatsApp being pushed onto the compromised device via fake updates. The apps look legitimate to the user, but malicious code sends information -- including messages, photos and contacts -- to a central command and control server. Deploying these apps requires a side-loading injection technique, which allows for the ability to ask for additional permissions, execute code and steal information from the original application.
not that this anyone else is better but are they immune to bad public relations?
I'm quakin' in my boots, over here!
But wait, I thought the App Store made Apple immune to malware, which is why it's supposed to be so much better than Android, at the cost of not being able to run the apps you want without paying Apple for the privilege.
Oops!
You know, these used to just be called "Trojans". But that long-winded description works, too.
Fun statement: Because this is iOS, Apple can shut this down in 5 seconds. Why? Because every MDM for iOS has to have a cert signed by Apple for the push commands from the MDM to be sent to the devices.
So what this really means is a bunch of hackers successfuly paid Apple to create a malware cert for them. Then proceeded to create an automated installer for an MDM to sick on clueless users.
Can we finally admit that keeping users dumb is bad now? There's no amount of third party "protection" that will prevent this crap, and all it will wind up doing is just making it even more difficult for people and organizations to control or use the devices they own.
I can picture it now....EV Certs required to get a developer's cert. Or worse, wanna install an app? We'll need a copy of that Internet Driver's License of yours....
Thirteen users ... have been been compromised in the attacks. ... The campaign has been active since August 2015.
13 people over 3 years, and it's news? That might be news if it was the "13 Angry Democrats" that Trump fellow keeps complaining about, or some other list of important-ish people of some sort, but I'm not going to bother reading the article to find out cause there should be some hint of that in the summary.
Seems like MDM is a codeword for what we call 'antivirus" on a PC/Mac. The antivirus developers have been given hooks that go all the way to BIOS, while a typical program can't touch system files nor the BIOS. We expect the certified antivirus programs to play by rules, but there's nothing preventing things like Norton's occasional behavior of starting P2P hole checks that end up overflowing the internet pipes.
So, here we are with a bunch of India cases of users trusting malware as their iPhone MDM/antivirus. Really, the operating system should be the only antivirus you need these days. So Apple, pull this app from the app store and replace the damaged phones.
Thank you, and Good-nite Putin's America!
An iOS clone, with nothing added, just different listeners for the data....
Top notch reporting, new new new slashdot style. Complete drivel that means diddly squat. Very beauhd, wow.
Did anyone else initially read the headline as being about a political campaign using iPhone malware to research their target voters?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way