Popular Chinese iOS apps compromised in malware attack • Hacker News Board

Re: Popular Chinese iOS apps compromised in malware attack

#21

Post by paradite » Sat, Sep 19, 2015, 5:24 AM UTC

tomkwok wrote: post #4

@XcodeGhostSource on GitHub claims to be the author of the malware and open-sourced it and apologizes. "XcodeGhost" Source: https://github.com/XcodeGhostSource/XcodeGhost

What I am interested in is the authenticity of this source. Could it be a "modified" source with the personal-info-tracking code removed? Any confirmation on this?

Re: Popular Chinese iOS apps compromised in malware attack

#22

Post by iamshs » Sat, Sep 19, 2015, 5:33 AM UTC

chvid wrote: post #14

Really? So the developers of wechat had their xcode infected by something and now an unauthorized tracker is on the ios wechat app?! Wechat with about 500 mio users! Probably running on about 90% of Chinese-owned iPhones. I would like to see some independent confirmation of that.

According to the following link, Tencent, developer of WeChat has made a statement that version 6.2.5 is affected and users should update. I think that's pretty credible.

http://researchcenter.paloaltonetworks.com/2015/09/malware-x...

http://mt.sohu.com/20150918/n421556810.shtml

Re: Popular Chinese iOS apps compromised in malware attack

#23

Post by paradite » Sat, Sep 19, 2015, 5:39 AM UTC

I find it interesting that the source code on GitHub was committed by 2 different users with the same user name XcodeGhostSource, one for the code and one for the README.md. Are these two separate persons? Or maybe the one for the code was committed before using the same email to register GitHub account?

https://github.com/XcodeGhostSource/XcodeGhost/commits/maste...

Re: Popular Chinese iOS apps compromised in malware attack

#24

Post by gress » Sat, Sep 19, 2015, 5:51 AM UTC

anti_spy_zzz wrote: post #13

What about Android? Can the same scheme happen to Eclipse and affect Android apps, too? Now, do we all switch to Windows phones?

This scheme isn't needed with Android since most devices are vulnerable to well known exploits.

Re: Popular Chinese iOS apps compromised in malware attack

#25

Post by aianus » Sat, Sep 19, 2015, 5:51 AM UTC

The internet in China is so bad developers at Tencent download Xcode from random links on Chinese Dropbox? Pathetic.

Re: Popular Chinese iOS apps compromised in malware attack

#26

Post by superuser2 » Sat, Sep 19, 2015, 6:03 AM UTC

Remember the NSA's infamous "I hunt sysadmins" [1].

Software engineers, ops people, and sysadmins at big tech companies with interesting data are high-value targets. If you can can run code on production infrastructure or a large install base, you should assume you are being actively, personally targeted by multiple advanced persistent threats, including at least one state intelligence agency, and adjust your OPSEC accordingly.

They want into your infrastructure, and the easiest way into your infrastructure may well be your SSH key.

What's paranoid for the general public is a pretty good idea for you.

[1] https://theintercept.com/2014/03/20/inside-nsa-secret-effort...

Re: Popular Chinese iOS apps compromised in malware attack

#27

Post by sigterm » Sat, Sep 19, 2015, 6:08 AM UTC

aianus wrote: post #25

The internet in China is so bad developers at Tencent download Xcode from random links on Chinese Dropbox? Pathetic.

It's bad when crossing the border. Rumor says it's due to traffic analysis by the GFW. I cannot find any source to prove or disprove that though.

Re: Popular Chinese iOS apps compromised in malware attack

#28

Post by dengnan » Sat, Sep 19, 2015, 6:09 AM UTC

chvid wrote: post #14

Really? So the developers of wechat had their xcode infected by something and now an unauthorized tracker is on the ios wechat app?! Wechat with about 500 mio users! Probably running on about 90% of Chinese-owned iPhones. I would like to see some independent confirmation of that.

It's true and if you read Chinese, it is already all over the Internet.

On twitter, most of them are under #XcodeGhost[0].

Besides, the (alleged) author has put the source code on github[1].

0. https://twitter.com/hashtag/XcodeGhost?src=hash

1. https://github.com/XcodeGhostSource/XcodeGhost

Update 1: Add the source code of XcodeGhost

Re: Popular Chinese iOS apps compromised in malware attack

#29

Post by jupiter2 » Sat, Sep 19, 2015, 6:11 AM UTC

kccqzy wrote: post #8

jupiter2 wrote: post #5

Honestly... what's the difference between this kind of malware and the data-mining performed on websites, OSes (Windows 10, Android, iOS..), cellular companies, government backdoors, etal..? It's sickening (and criminal) that it's gotten to the point it has.

Did you read the article? This isn't a company intentionally mining user data, which is usually not criminal, as the EULA would have allowed those companies to do so. This is developers downloading Xcode from third-party sources, which are compromised and would inject third-party code to iOS apps sending analytics to a third-party server, without knowledge of the original developer.

Your missing the point of my comment. The whole system of data-mining, surveillance, stalking, sharing of data with untold 3rd-parties IS criminal - eula or otherwise. The only thing these guys did that breaks with 'current accepted (criminal) practices' is that they modified someone else's code to do what everyone else is already doing.

So yes... I read the article and a bit more...

Re: Popular Chinese iOS apps compromised in malware attack

#30

Post by quink » Sat, Sep 19, 2015, 6:12 AM UTC

vinceyuan wrote: post #7

Downloading apps from App Store is very slow in China and sometimes you can't even open App Store successfully. It's not Apple's fault (but Apple should do something to solve it). The real cause is the gov and GFW. Many developers use XunLei(Thunder, a p2p downloading tool) to accelerate downloading. I used it too when I was in Shanghai China. After I moved to Hong Kong, I always download directly from App Store and…

What can Apple reliably do without exposing the source code and attribution (with signig) of every file used to generate the app, run inside a signed environment on a locked down computer?

Please. This is the GFW.