Apple yanks malware from AppStore that targets non-jailbroken iPhones
- 17 March, 2016 08:54
China proves again to be the frontline of new malware attacks on the iPhone with Apple recently pulling three malicious apps from its App Store.
The malicious apps, discovered by security firm Palo Alto Networks, exploit “design flaws” in an Apple digital rights management (DRM) feature known as Apple FairPlay that is used to securely hand-off apps downloaded through iTunes on the desktop to an iPhone.
Apple has now removed the three malicious apps that security firm has called collectively “AceDeceiver”. All three posed as wallpaper apps.
Unlike previous iOS malware, the malicious apps don’t rely on enterprise certificates to infect iPhones, such as the YiSpecter malware that also targeted non-jailbroken Chinese iPhones.
Instead, the attackers use a so-called man-in-the-middle attack on FairPlay carried out by a rogue iOS utility for Windows machines, called Aisi Helper. An iPhone can be infected once physically connected to a computer with the attack program installed.
“Aisi Helper purports to be software that provides services for iOS devices such as system re-installation, jailbreaking, system backup, device management and system cleaning. But what it’s also doing is surreptitiously installing the malicious apps on any iOS device that is connected to the PC on which Aisi Helper is installed,” Claud Xiao, a researcher at Palo Alto Networks explains.
The DRM aspect of the attack arises from the attackers being able to intercept an authorisation code after purchasing an app from the App Store. This is used to simulate iTunes client behaviours on a PC and, according to Xiao, “tricks iOS devices to believe the app was purchased by the victim”.
The attack also appears to be an effort to phish App Store and iTunes credentials from potential victims by the now-removed malicious apps leading them to a non-Apple app store.
Xiao suggests Apple’s review process may be a little too US-centric since the three malicious apps escaped detection in at least seven reviews and only displayed bad behaviour when reaching iPhones from China.
“In this case, AceDeceiver only displays malicious behaviors when a user is located in China, but that would be easy for the attacker to change in any time,” he noted.
Last chance to register for the CSO Perspectives Roadshow on March 22nd.
- Hear from International keynote speakers:Robert Lentz, and Graham Cluley,
- A Security Awareness stream
- 18 different interactive Security Exchange discussions
Join CSO for a day of networking with your peers, engaging and discussing topics relevant to you, hearing from some of the top worldwide IT Security leaders in the market and attending the exhibition floor to win some amazing prizes.
Participate in this short survey on IT security strategies across the Australian market and go in the draw to WIN a 360Fly camera vailued at $689.
