Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/3/2015
04:50 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

XCodeGhost Found Hiding In U.S. And In Apple iOS 9 Apps

Meanwhile, exploit broker Zerodium says it's paid a $1 million bounty for a remote iOS 9 zero-day.

XCodeGhost -- malware that snuck Trojanized iOS apps into the official App Store -- mostly threatened iOS users in China, but now researchers at FireEye have also found XCodeGhost-infected apps hitting targets in the United States. They also unearthed a stealthier variant, XCodeGhost S, that has weaponized iOS 9 apps and can bypass static detection.

XCodeGhost, first discovered in September, was the first malware to show that non-jailbroken iOS devices could be compromised. Attackers created a malicious version of Apple's application development software, Xcode, and uploaded it to Chinese cloud storage service Baidu Yunpan -- a regional, third-party alternative to the Apple Store where download times are shorter for iOS and Mac developers in China. Then, innocent app developers used XcodeGhost to write apps and upload them to the official App Store, never knowing that those apps were malicious -- over 4,000 apps in all.

Apple removed the compromised apps from the App Store. The command-and-control servers were taken offline -- apparently voluntarily by the malware authors -- but they could be hijacked by other threat actors, and researchers since have found that XCodeGhost is still in action.

Since most of the affected app developers were in China, most of the 4,000 infected apps were those popular in China, yet some are also "fairly popular" in the U.S. and have compromised American users, says Raymond Wei, FireEye's senior director of mobile development.

In a four-week period, FireEye found 210 U.S. enterprises with infected apps, generating over 28,000 attempts to connect to command-and-control servers. The machines currently infected are mostly calling back to servers located in Germany (62%) and the U.S. (33%).

"The main point," say Wei, "is that what was originally a threat in China is no longer just in China."

In their investigation, FireEye also unearthed another variant, XCodeGhost S, which has been updated to Trojanize apps for iOS 9.

The variant was in operation at the same time as the original XCodeGhost, and Wei says the same malware authors were responsible for creating it, even if they aren't responsible for its most recent activity.

Sep. 19, two days after the original XCodeGhost began attracting attention in China, someone claiming responsibility for it tweeted an apology, using the account @XcodeGhost-Author, saying it was just a coding experiment to explore the potential exploitation of a loophole in Xcode to enable advertisement delivery. 

But Hong Jia, a researcher at ThreatBook Labs, a threat intelligence start-up based in China, told DarkReading last month that she wasn't convinced the apology was genuine -- partly because the code had stealth capabilities that went beyond what the authors claimed it did.

XCodeGhost S's stealth functions include the ability to bypass static detection tools by using character concatenation. Wei says that is making it more difficult for FireEye to find the apps infected with XCodeGhost S than the original variant. So far they've found two infected apps, but they expect to find more.

Now that this malware has been successful in cracking the Apple development environment's walls of trust, will other attackers take the same approach?

"I think it's possible, but I think it's unlikely to be the same kind of tactic," because of Apple's swift action to block that sort of attack, Wei says. Regardless of the approach, however, app developers will always be a soft target, he says.

"The alert raised by FireEye is very important," says ThreatBook Labs' Jia. "[Users] should upgrade their iOS to latest version and upgrade the infected Apps as soon as possible to avoid being hijacked, which is not a difficult thing to do by hacker."

Million-Dollar Bug Bounty

In other Apple news, intelligence contractor-slash-exploit broker Zerodium stated on Twitter that it paid out the $1 million bug bounty it promised for a remote iOS 9 exploit. The vulnerability is a browser-based jailbreak exploit.

Similar to Hacking Team, Zerodium sells zero-day vulnerabilities to government agencies to be used in offensive tools. Zerodium founder Chaouki Bekrar told The Register "We will first report the vulnerabilities to our customers, and we may later report them to Apple."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Dogue de Bordeaux
0%
100%
Dogue de Bordeaux,
User Rank: Apprentice
11/4/2015 | 5:37:17 AM
I'm shocked !
I'm shocked !
Until then, they sold me Apple as protected from any viruses or malware!
Finally, the iPhone is protected from malware that Android;)
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Introducing 'Secure Access Service Edge'
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  7/3/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15001
PUBLISHED: 2020-07-09
An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access codes on OTP slots. This access code is intended to prevent unauthorized changes to OTP configurations. The access code is not checked when u...
CVE-2020-15092
PUBLISHED: 2020-07-09
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most T...
CVE-2020-15093
PUBLISHED: 2020-07-09
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A ...
CVE-2020-15299
PUBLISHED: 2020-07-09
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is execu...
CVE-2020-4173
PUBLISHED: 2020-07-09
IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure l...