Mobile

2/4/2015
08:40 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Apple iOS Now Targeted In Massive Cyber Espionage Campaign

Attack campaign tied to Russia now zeroing in on mobile user's iPhones, iPads.

An extensive and sophisticated cyber espionage operation targeting mainly Western military, government, defense industry firms, and the media, now has a new weapon: a spyware app for Apple iPhones and iPads.

Operation Pawn Storm, which has been tied to Russia by at least one security research firm, is using a specially crafted iOS app to surreptitiously steal from the mobile device text messages, contact lists, pictures, geo-location information, WiFi status of the device, lists of installed apps and processes -- and to record voice conversations, according to new Trend Micro research.

"The Cold War has returned in cyberspace, and Apple has become the gateway to western elites," says Tom Kellermann, chief cyber security officer with Trend Micro. "Pawn Storm has evolved to now incorporate proximity attacks against Western victims."

Trend Micro researchers, who found the iOS malware while studying and tracking Operation Pawn, say they believe the Apple spyware gets installed on systems already compromised by the attackers. It's similar to the "next-stage" SEDINT malware they found targeting Microsoft Windows systems.

"We found two malicious iOS applications in Operation Pawn Storm. One is called XAgent (detected as IOS_XAGENT.A) and the other one uses the name of a legitimate iOS game, MadCap (detected as IOS_ XAGENT.B). After analysis, we concluded that both are applications related to SEDNIT," wrote Trend mobile threat analysts Lambert Sun and Brooks Hong and senior threat researcher Feike Hacquebord, in a blog post today.

"The obvious goal of the SEDNIT-related spyware is to steal personal data, record audio, make screenshots, and send them to a remote command-and-control (C&C) server. As of this publishing, the C&C server contacted by the iOS malware is live," they said.

When XAgent runs on iOS 7, its icon doesn't show up on the mobile device. It's hard to kill, too: When the researchers attempted to terminate the app's process, it restarted right away. When running on iOS 8, however, the icon is not hidden and doesn't automatically restart after it's killed. The researchers say this shows the malware was created before iOS 8's release in September of last year.

"We can see that the code structure of the malware is very organized. The malware looks carefully maintained and consistently updated," the researchers said.

Operation Pawn Storm cyberattacks have intensified in the wake of US-Russian tensions, and the organizations and regions targeted appear to point to Russia or Russian interests. The attackers are going after the US, NATO allies, and Russian dissidents. Among the targets of some phishing attacks used in the campaign are ACADEMI (the US defense contractor formerly known as Blackwater), SAIC, and the Organization for Security and Cooperation in Europe.

Trend Micro so far has stopped short of attributing the attacks to Russia. Researchers at FireEye, however, recently called out the Russian government as being behind the Operation Pawn Storm campaign--specifically the so-called APT28 hacking group. "This Russian government-backed type of espionage has been very mysterious and hard to nail down over all these years on the Internet," Dan McWhorter, lead researcher for the report and vice president of threat intelligence for FireEye, told Dark Reading in October.  "In my opinion after looking at our research, it confirms that yes, in fact, the Russian government is doing this, and it gives us a body of evidence to put against that assertion that wasn’t there previously."

Just how victims' Apple iOS devices get infected with the spyware is unknown thus far. In one case, the researchers found a "Tap Here to Install the Application" prompt to lure users into installing the app. Another possible vector, they say, is via a compromised Windows laptop when the iPhone is connected to it with a USB cable. The attackers employ Apple's "ad-hoc provisioning" method of distributing the app. 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AndrewH835
50%
50%
AndrewH835,
User Rank: Apprentice
4/3/2015 | 12:40:00 AM
Nice article
Just wanted to compliment the author on a good article. Kudos.
AppariganiS084
50%
50%
AppariganiS084,
User Rank: Apprentice
2/22/2015 | 10:03:33 AM
Re: "Gateway to Western Elites"?
I would tend to agree if the sought after data resides on those machines. The difficulty I'm having is with human behavior.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
2/9/2015 | 10:24:25 AM
Re: "Gateway to Western Elites"?
"especially since DoD computers and similar are going to have so many lockdowns on them that this malware most likely would never get there in the first place" Ordinarily, I would tend to agree if the sought after data resides on those machines. The difficulty I'm having is with human behavior. It is a given that some government officials use public web services such as gmail, etc. in the performance of their official duties. How far of a stretch would it be to think that government officials use connected personal devices to access those public services, or for accessing anything else in their official capacity?
ttueric
33%
67%
ttueric,
User Rank: Apprentice
2/8/2015 | 10:23:57 PM
Re: "Gateway to Western Elites"?
So on an Apple device, but only gets on through a Windows computer (probably jailbroken phones as well).  Not surprising.  Something they leave out though - how many devices might have this?  Guess it is probably a very small number, especially since DoD computers and similar are going to have so many lockdowns on them that this malware most likely would never get there in the first place.  So, this really isn't an Apple problem, or iOS problem at all.
jastroff
33%
67%
jastroff,
User Rank: Strategist
2/5/2015 | 4:25:21 PM
"Gateway to Western Elites"?
For all my sanctimonious Apple user friends who wouldn't get security when I asked them to because they felt Apple isn't Microsoft, and Apple won't get attacked cause they are the "good" guys.

This one's for you folks
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Data Privacy Careers Are Helping to Close the IT Gender Gap
Dana Simberkoff, Chief Compliance and Risk Management Officer, AvePoint, Inc,  8/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15601
PUBLISHED: 2018-08-21
apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism.
CVE-2018-15603
PUBLISHED: 2018-08-21
An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the Author field of the "Leave a Comment" screen.
CVE-2018-15598
PUBLISHED: 2018-08-21
Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.
CVE-2018-15599
PUBLISHED: 2018-08-21
The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.
CVE-2018-0501
PUBLISHED: 2018-08-21
The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.