Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

3/17/2016
05:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Apple iPhone Malware Exploits DRM Mechanism To Spread

But threat limited mainly to users looking to jailbreak phone or install pirated apps.

A new family of Apple iOS malware that has begun affecting users in China is another reminder of why it is generally not a good idea to jailbreak your iPhone or to download pirated software from unofficial mobile app stores.

The malware, dubbed AceDeceiver, has grabbed some attention for its ability to infect non-jailbroken iPhones just as easily as it can jailbroken ones.

Security vendor Palo Alto Networks, which reported on the threat this week, describes AceDeceiver as malware that exploits flaws in Apple’s Digital Rights Management (DRM) technology to install itself without any of the security mechanisms that are normally required.

AceDeceiver is the first malware to exploit a technique called “FairPlay Man-In-The-Middle (MITM)” that hackers have typically used to distribute pirated iOS software.

For the moment at least, AceDeceiver poses a threat only to users of a software tool called Aisi Helper. Many people in China have installed the tool on their Windows PCs to manage their iOS devices, says Ryan Olson, director of threat intelligence at Palo Alto Networks’ Unit 42.

Aisi Helper purports to help users carry out tasks like system re-installation, backup, and cleaning for iOS devices. It also serves as a tool for jailbreaking iOS devices and is often used by people who want to install free and likely pirated apps on their phones, Olson says.

According to Palo Alto Networks, as of Dec 2014, some 15 million people had downloaded the tool, and 6.6 million were using it actively.

Once installed on a PC, Aisi Helper surreptitiously downloads and installs AceDeceiver on the system, which in turn connects to a third-party iOS app store controlled by the authors of the software.

AceDeceiver prompts users for their AppleID and passwords, which it then sends to a remote server though it is not clear what exactly the authors of the software are doing or plan to do with it, Olson says.

The manner in which the malware authors have exploited Apple’s DRM mechanism to install AceDeciever on non-jailbroken iPhones is really the big issue, Palo Alto researcher Claud Xiao wrote in the company’s alert on the threat.

First, the authors of the malware managed to upload three versions of AceDeceiver to Apple’s official App Store by evading the company’s code review and filtering mechanisms, on seven separate occasions. Each time the app was disguised as a wallpaper app.

Apple has since removed the apps, but the authors of the malware can still distribute it by taking advantage of an Apple DRM mechanism called FairPlay.

FairPlay lets users purchase and download iOS apps from Apple’s App Store to their Macs or PCs, via iTunes. When a user then wants to upload the app to their iPhone or iPad, the device first checks with the iTunes software for an authorization code to ensure the app has been legally purchased.

Back in 2013, hackers discovered that by intercepting the communication between an iPhone or iPad and a Mac or PC that has downloaded an app from App Store, they could retrieve the authorization code and then use it to install the same app on other devices.

“The authorization codes differ from authorized computer to computer, but between the authorized computer and the phones there is not a check against a User ID,” Olson says. “So if a system has been authorized for an app, the MITM allows that app to be installed on many phones.”

In this case, all that the malware authors had to do was upload AceDeceiver to the App Store and then download it to a Mac or PC to get an authorization code for that computer, which they could then use repeatedly to install the malware on multiple iPhones and iPads.

What makes the technique dangerous is that it doesn’t require apps to have an enterprise certificate and therefore is not under the control of mobile device management tools, Xiao said. The method also doesn’t require users to take any manual action to install the malicious app.

In this case, the attack requires users to have downloaded and install Aisi Helper. The malware is also explicitly designed to work in China. Users from other regions who downloaded AceDeceiver while it was still available in App Store will only see the screensaver.

But there’s no reason why the same approach cannot be tweaked to deliver AceDeceiver and other malware in other regions as well.

“No technical reason exists,” says Guillaume Ross, senior security consultant, at Rapid7 in comments to Dark Reading. “It is possible that the Chinese market is slightly more susceptible to it due to the prevalence of third party application stores [and] more common use of jailbreaking tools,” he says.

 

Related Content:

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: -when I told you that our cyber-defense was from another age
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-3350
PUBLISHED: 2019-11-19
masqmail 0.2.21 through 0.2.30 improperly calls seteuid() in src/log.c and src/masqmail.c that results in improper privilege dropping.
CVE-2011-3352
PUBLISHED: 2019-11-19
Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by setting default, modifying and deleting themes. A remote attacker with Zikula administrator privilege could use this flaw to execute arbitrary HTML or web script code in the context ...
CVE-2011-3349
PUBLISHED: 2019-11-19
lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled folders. A local user can overwrite root-owned files via a symlink, which can allow possible privilege escalation.
CVE-2019-10080
PUBLISHED: 2019-11-19
The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI ...
CVE-2019-10083
PUBLISHED: 2019-11-19
When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.