Slashdot Mirror
Hacking Campaign Targets iPhone Users With Data-Stealing, Location-Tracking Malware (zdnet.com)
ZDNet reports of a new mobile malware campaign that is "gaining access to iPhones by tricking users to download an open-source mobile device management (MDM) software package." From the report: Once in control, the unidentified hackers can steal various forms of sensitive information from infected devices, including the phone number, serial number, location, contact details, user's photos, SMS, and Telegram and WhatsApp chat messages. Thirteen users -- all in India -- have been been compromised in the attacks, which have been detailed by Cisco Talos. Those infected use a range of iPhone models and are running iOS versions ranging from 10.2.1 to 11.2.6. The campaign has been active since August 2015. The attackers take control by using the MDM package, which can give attackers complete control of the device and the ability to install fake versions of real apps.
Two different MDM services are used in the campaign, enabling system-level control of multiple devices from one location and the ability to install, remove and exfiltrate data from apps. One method of stealing data comes via malicious versions of messaging services like Telegram and WhatsApp being pushed onto the compromised device via fake updates. The apps look legitimate to the user, but malicious code sends information -- including messages, photos and contacts -- to a central command and control server. Deploying these apps requires a side-loading injection technique, which allows for the ability to ask for additional permissions, execute code and steal information from the original application.
Two different MDM services are used in the campaign, enabling system-level control of multiple devices from one location and the ability to install, remove and exfiltrate data from apps. One method of stealing data comes via malicious versions of messaging services like Telegram and WhatsApp being pushed onto the compromised device via fake updates. The apps look legitimate to the user, but malicious code sends information -- including messages, photos and contacts -- to a central command and control server. Deploying these apps requires a side-loading injection technique, which allows for the ability to ask for additional permissions, execute code and steal information from the original application.
You know, these used to just be called "Trojans". But that long-winded description works, too.
What we have here is a malware program that got certified by Apple... but this appears to only be in India's version of the app store. Cleanup should be quick, and it's less than 20 reported cases of trouble so far.
It's an Apple App Store error... they approved a piece of malware that used MDM software elevation to get through limits on typical apps.
MDM stands for Mobile Device Manager. It's purpose is to allow the management of devices without physical presence for tasks like setting / enforcing security policies, (un / re)installing or updating applicatons, managing user preferences, network configuration, etc.
The closest thing on a PC / MAC is either Active Directory's Group Policies, or third party software like Puppet.
It has nothing to do with antivirus software.
The MDM app wasn't the issue either. Apple has no reason to blacklist an MDM app. The malware author's certs yes, but the apps themselves no. Don't blame an app for doing what the clueless user told it to do.
Also nothing an MDM app can do will survive a factory reset. Apple has no "damaged" phones to replace, but they really do need to do something about educating their ignorant users.
Also, your astroturfing is annoying even to the ACs, but to address that as well:
That's a standard kind security vunerability, leftover debugging / test code, that you can find in just about anything. Also no legit iOS app "sideloads" on consumer devices. It's either downloaded from the App Store, or it's installed as an enterprise app from a device profile using Apple Configurator, and even the enterprise apps have to be signed using a cert issued by Apple to that enterprise.
No, if you read TFA at all, you'd would have seen this: At this time, we don't know how the attacker managed to enroll the targeted devices. Enrollment could be done through physical access to the devices, or most likely by using social engineering to entice a user to register.
So given a probable lack of physical access, we are left with classic social engineering of clueless users as a root cause. No amount, of protection provided by Apple could prevent that, unless Apple prohibited the user from using the device at all. But I'd imagine that level of "protection" would not be very profitable for Apple. Nor desirable by said users.
Once again, this has nothing to do with antivirus.
What we have here is a malware program that got certified by Apple...
Based on the vague description in the article... I don’t believe that’s the case.
The article refers to a multistep process and tricking users into adding certificates as trusted. This sounds more like an end-around the App Store - if your phone trusts a certificate, you can load developer apps directly onto a phone via Xcode, Cydia Impactor, or other similar tools. You’re basically side-loading an app without having to get past the App Store’s restrictions.
#DeleteChrome
The security services and police would not be the only ones with consumer product skills.
Domestic spying is now "Benign Information Gathering"
MDM files don't need to be certified by Apple but installing them takes a decent bit. You receive multiple warnings and have to enter your password for the device. You then need to restart the device after installation. These are the same files that you'd install to allow your workplace to manage your device and secure it in a way they deem proper to have company email and other access from your device. Basically gives them full control to configure your device. Again, it's not something most would install by accident.
This isn't a hack. It's tricking 13 really dumb people into installing a certificate on their phone after giving their passcode and then confirming that they understand they're giving the certificate owner full access to their device. Apple has multiple warnings in place here and the user is simply ignoring them. These MDM certificates are the same thing you'd install to give your workplace access to manage your device remotely and configure it securely to access company email and other files. This isn't a security exploit but rather an exploit of a couple really dumb people willing to hand over full access to their phone. They'd probably hand over their house keys just as easily.