Popular Chinese iOS apps compromised in malware attack • Hacker News Board

Re: Popular Chinese iOS apps compromised in malware attack

#11

Post by e28eta » Sat, Sep 19, 2015, 4:26 AM UTC

A Chinese coworker sent me this link this morning, but HN said it had already been submitted (but I couldn't find it): http://researchcenter.paloaltonetworks.com/2015/09/novel-mal...

If you're going to target developers, I'd think their keychain contents would be valuable too. Grab their Apple account credentials and their signing credentials. Have Xcode phone home, and custom craft a payload for their app.

Re: Popular Chinese iOS apps compromised in malware attack

#12

Post by zminjie » Sat, Sep 19, 2015, 4:26 AM UTC

AntiRush wrote: post #10

I'm trying to figure out if the version of WeChat I have installed is compromised. I haven't been able to find any specifics about versions of any of the apps. Does anyone have more info?

According to Tencent, only 6.2.5 is compromised. If you updated to 6.2.6 you should be fine.

Re: Popular Chinese iOS apps compromised in malware attack

#13

Post by anti_spy_zzz » Sat, Sep 19, 2015, 4:28 AM UTC

What about Android? Can the same scheme happen to Eclipse and affect Android apps, too?

Now, do we all switch to Windows phones?

Re: Popular Chinese iOS apps compromised in malware attack

#14

Post by chvid » Sat, Sep 19, 2015, 4:34 AM UTC

Really?

So the developers of wechat had their xcode infected by something and now an unauthorized tracker is on the ios wechat app?!

Wechat with about 500 mio users! Probably running on about 90% of Chinese-owned iPhones.

I would like to see some independent confirmation of that.

Re: Popular Chinese iOS apps compromised in malware attack

#15

Post by smaili » Sat, Sep 19, 2015, 4:41 AM UTC

> The compromised version of Xcode was hosted on Baidu Pan. It is unlikely that Baidu was aware of the compromised version of Xcode.

I'm sorry, but at this point I no longer think "it is unlikely" Baidu was unaware. I find it too coincidental based on the simple fact that they were also involved with the DDoS attack on GitHub earlier this year.

Re: Popular Chinese iOS apps compromised in malware attack

#16

Post by x0054 » Sat, Sep 19, 2015, 4:45 AM UTC

anti_spy_zzz wrote: post #13

What about Android? Can the same scheme happen to Eclipse and affect Android apps, too? Now, do we all switch to Windows phones?

Windows phone is indeed a much safer OS for the moment. Security by obscurity. It worked for OSX for quite some time in the 90s and early 2000s :)

Re: Popular Chinese iOS apps compromised in malware attack

#17

Post by paradite » Sat, Sep 19, 2015, 5:01 AM UTC

smaili wrote: post #15

> The compromised version of Xcode was hosted on Baidu Pan. It is unlikely that Baidu was aware of the compromised version of Xcode. I'm sorry, but at this point I no longer think "it is unlikely" Baidu was unaware. I find it too coincidental based on the simple fact that they were also involved with the DDoS attack on GitHub earlier this year.

The source is also hosted on GitHub, so GitHub must be involved in this? Funny logic, I bet you have never used Baidu Pan, and has no idea how it is used by millions of Chinese people everyday.

Re: Popular Chinese iOS apps compromised in malware attack

#18

Post by Ankaios » Sat, Sep 19, 2015, 5:08 AM UTC

Makes me wonder if any other tool chains / compilers have already been co-opted in the wild.

Re: Popular Chinese iOS apps compromised in malware attack

#19

Post by rahimnathwani » Sat, Sep 19, 2015, 5:10 AM UTC

smaili wrote: post #15

> The compromised version of Xcode was hosted on Baidu Pan. It is unlikely that Baidu was aware of the compromised version of Xcode. I'm sorry, but at this point I no longer think "it is unlikely" Baidu was unaware. I find it too coincidental based on the simple fact that they were also involved with the DDoS attack on GitHub earlier this year.

"Baidu Yun" is an online file locker (like Dropbox) with a generous free quota. You can create a shareable link for a file with a single click. Why would you think someone at Baidu would have knowledge of a particular file a user shared on that service?

Separately, you bring up Baidu's "involvement" in the DDoS attack on GitHub. I remember reading that this was achieved using a man-in-the-middle attack on customers of Baidu's analytics product, which would not need Baidu's cooperation: http://www.netresec.com/?page=Blog&month=2015-03&post=China%...

Re: Popular Chinese iOS apps compromised in malware attack

#20

Post by molecule » Sat, Sep 19, 2015, 5:12 AM UTC

> If you are an iOS developer, however, a lot can be done to secure your development system:... Separate your development system with your everyday system. Development systems should be used solely for development and not for browsing random sites. If physical separation presents too much of a problem for developers, at the very least, a dedicated user account for development should be used.

I'm not an application developer, but I haven't seen this recommended before and it sounds a bit extreme. Is it a standard, recommended best practice for development environments that must sign code?