Vulnerabilities / Threats // Advanced Threats
3/17/2016
05:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Apple iPhone Malware Exploits DRM Mechanism To Spread

But threat limited mainly to users looking to jailbreak phone or install pirated apps.

A new family of Apple iOS malware that has begun affecting users in China is another reminder of why it is generally not a good idea to jailbreak your iPhone or to download pirated software from unofficial mobile app stores.

The malware, dubbed AceDeceiver, has grabbed some attention for its ability to infect non-jailbroken iPhones just as easily as it can jailbroken ones.

Security vendor Palo Alto Networks, which reported on the threat this week, describes AceDeceiver as malware that exploits flaws in Apple’s Digital Rights Management (DRM) technology to install itself without any of the security mechanisms that are normally required.

AceDeceiver is the first malware to exploit a technique called “FairPlay Man-In-The-Middle (MITM)” that hackers have typically used to distribute pirated iOS software.

For the moment at least, AceDeceiver poses a threat only to users of a software tool called Aisi Helper. Many people in China have installed the tool on their Windows PCs to manage their iOS devices, says Ryan Olson, director of threat intelligence at Palo Alto Networks’ Unit 42.

Aisi Helper purports to help users carry out tasks like system re-installation, backup, and cleaning for iOS devices. It also serves as a tool for jailbreaking iOS devices and is often used by people who want to install free and likely pirated apps on their phones, Olson says.

According to Palo Alto Networks, as of Dec 2014, some 15 million people had downloaded the tool, and 6.6 million were using it actively.

Once installed on a PC, Aisi Helper surreptitiously downloads and installs AceDeceiver on the system, which in turn connects to a third-party iOS app store controlled by the authors of the software.

AceDeceiver prompts users for their AppleID and passwords, which it then sends to a remote server though it is not clear what exactly the authors of the software are doing or plan to do with it, Olson says.

The manner in which the malware authors have exploited Apple’s DRM mechanism to install AceDeciever on non-jailbroken iPhones is really the big issue, Palo Alto researcher Claud Xiao wrote in the company’s alert on the threat.

First, the authors of the malware managed to upload three versions of AceDeceiver to Apple’s official App Store by evading the company’s code review and filtering mechanisms, on seven separate occasions. Each time the app was disguised as a wallpaper app.

Apple has since removed the apps, but the authors of the malware can still distribute it by taking advantage of an Apple DRM mechanism called FairPlay.

FairPlay lets users purchase and download iOS apps from Apple’s App Store to their Macs or PCs, via iTunes. When a user then wants to upload the app to their iPhone or iPad, the device first checks with the iTunes software for an authorization code to ensure the app has been legally purchased.

Back in 2013, hackers discovered that by intercepting the communication between an iPhone or iPad and a Mac or PC that has downloaded an app from App Store, they could retrieve the authorization code and then use it to install the same app on other devices.

“The authorization codes differ from authorized computer to computer, but between the authorized computer and the phones there is not a check against a User ID,” Olson says. “So if a system has been authorized for an app, the MITM allows that app to be installed on many phones.”

In this case, all that the malware authors had to do was upload AceDeceiver to the App Store and then download it to a Mac or PC to get an authorization code for that computer, which they could then use repeatedly to install the malware on multiple iPhones and iPads.

What makes the technique dangerous is that it doesn’t require apps to have an enterprise certificate and therefore is not under the control of mobile device management tools, Xiao said. The method also doesn’t require users to take any manual action to install the malicious app.

In this case, the attack requires users to have downloaded and install Aisi Helper. The malware is also explicitly designed to work in China. Users from other regions who downloaded AceDeceiver while it was still available in App Store will only see the screensaver.

But there’s no reason why the same approach cannot be tweaked to deliver AceDeceiver and other malware in other regions as well.

“No technical reason exists,” says Guillaume Ross, senior security consultant, at Rapid7 in comments to Dark Reading. “It is possible that the Chinese market is slightly more susceptible to it due to the prevalence of third party application stores [and] more common use of jailbreaking tools,” he says.

 

Related Content:

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Cybercrime has become a well-organized business, complete with job specialization, funding, and online customer service. Dark Reading editors speak to cybercrime experts on the evolution of the cybercrime economy and the nature of today's attackers.