Is it possible that developer outside China download the infected Xcode? if so, it will be critical issue.
Popular Chinese iOS apps compromised in malware attack
51–60 of 89 posts
Re: Popular Chinese iOS apps compromised in malware attack
#52Think only Chinese iOS Apps are affected? Think again, because your favorite app might just be outsourced to Chinese developers. Apps like Mercury, WinZip, PDFReader are reported to be affected by this Xcode trojan (have been taken down by Apple). http://researchcenter.paloaltonetworks.com/2015/09/malware-x...
IOS now is the most dangerous platform...
Re: Popular Chinese iOS apps compromised in malware attack
#53Is it possible that developer outside China download the infected Xcode? if so, it will be critical issue.
Surely you can.
Re: Popular Chinese iOS apps compromised in malware attack
#54Remember the NSA's infamous "I hunt sysadmins" [1]. Software engineers, ops people, and sysadmins at big tech companies with interesting data are high-value targets. If you can can run code on production infrastructure or a large install base, you should assume you are being actively, personally targeted by multiple advanced persistent threats, including at least one state intelligence agency, and adjust your OPSEC a…
To give some practically implementable advice, what you should do is run anything that parses untrusted input in a virtual machine or physically separate machine.
This means you should browse the web, read e-mail and read any Office/PDF/whatever files sent to you in a virtual machine that doesn't have access to anything more than strictly needed.
The reason is that most desktop software and OS kernels are not written with total security against NSA-like adversaries in mind, and as a result often have exploits that completely compromise the system. While they can still provide reasonable security against random attackers, they cannot provide any significant security against organizations (such as intelligence agencies) who can offer millions of dollars for exclusive access to unpatched exploits and MITM any connection.
You can install Qubes [https://www.qubes-os.org] if you want a system that makes it more convenient and secure to use virtual machines this way (and you trust its authors to not have backdoored it).
Furthermore, you should only install software from official sources and when you install software, you should make sure to check its digital signature or hash (from a separate virtual machine, since the one you are browsing with is potentially compromised as discussed above)
If you don't already have a trusted signing key stored on your machine, you should download the file itself or something guaranteeing its integrity if available (signing key, HTTPS certificate, file hash) from multiple Internet connections, such as a residential ISP, mobile ISP and multiple instances of Tor and make sure the downloaded data is the same. This is very likely to foil a targeted attack specifically designed to give a special trojaned version of the file or a replaced signing key under the attacker's control.
Of course it's impossible to defend against the original authors of the software being malicious or compromised themselves, or against an attack designed to give everyone maliciously altered software when you don't have a trusted key/certificate, but those are more likely to be discovered. Even if the downloaded software is malicious, if you are separating software by virtual machine as described above, the damage will be limited to the virtual machine the software runs in.
There are a lot of other things to consider, such as defending from physically targeted attacks (e.g. someone breaking in your home and installing a keylogger) if you are not anonymous and keeping your anonymity if you are.
Re: Popular Chinese iOS apps compromised in malware attack
#55Earlier quoted context omitted.
And dont run a checksum.
A checksum can only tell you if the file is identical to another. Even if it did - you downloaded the file from untrusted location for a reason - you don't have access to original source. Checksums are useless if you don't have access to an alternative source.
Xcode.app includes a digital signature, which can be checked with `codesign`. As all OS X comes bundled with Apple's root certificate, one can check for the validity of that application by oneself without any additional trusted source.
Or if the developers never disable GateKeeper and read the warning, they will know that the application is not genuine.
Re: Popular Chinese iOS apps compromised in malware attack
#56Earlier quoted context omitted.
What can Apple reliably do without exposing the source code and attribution (with signig) of every file used to generate the app, run inside a signed environment on a locked down computer? Please. This is the GFW.
I think that at least Apple could put the Xcode binary files onto a CDN inside China. I'm trying to download Xcode 7.0 from the App Store today, and it's still hanging after a few hours.
And when that CDN has a hiccup dozens of iOS developers go elsewhere.
Also, this is by no means an Xcode problem only. It potentially affects every piece of software and even code rehosted from github. Does that copy of that library developed on github, mirrored on Baidu, contain a backdoor?
Re: Popular Chinese iOS apps compromised in malware attack
#57The WeChat team posted a public bulletin 24 hours ago saying that their was no leaked user info and that the issue only affects WeChat 6.2.5 users on iOS and that newer versions are not affected. An English version was published several hours afterwards and can be found here:
http://blog.wechat.com/2015/09/19/fixed-security-flaw-in-wec...
Fixed Security Flaw in WeChat 6.2.5 for iOS
A security flaw, caused by an external malware, was recently discovered affecting iOS users only on WeChat version 6.2.5. This flaw has been repaired and will not affect users who install or upgrade WeChat version 6.2.6 or greater, currently available on the iOS App Store. Here are some important points about the situation.
1. The flaw, described in recent media reports, only affects WeChat v6.2.5 for iOS. Newer versions of WeChat (versions 6.2.6 or greater) are not affected.
2. A preliminary investigation into the flaw has revealed that there has been no theft and leakage of users’ information or money, but the WeChat team will continue to closely monitor the situation. 3. The WeChat tech team has extensive experience combating attempts to hack our systems. Once the security flaw was discovered, the team immediately took steps to secure against any theft of user information. 4. Users who encounter any issues can contact the team by leaving feedback in the “WeChat Team” WeChat account.
The WeChat Team September 18, 2015
Re: Popular Chinese iOS apps compromised in malware attack
#58The WeChat team posted a public bulletin 24 hours ago saying that their was no leaked user info and that the issue only affects WeChat 6.2.5 users on iOS and that newer versions are not affected. An English version was published several hours afterwards and can be found here: http://blog.wechat.com/2015/09/19/fixed-security-flaw-in-wec... Fixed Security Flaw in WeChat 6.2.5 for iOS A security flaw, caused by an exter…
The statement is controversy.
It said WeChat 6.2.5 has been affected. But it also said no leaked user info. If it was affected, how do you know there is no leaking? if the flaw doesn't theft anything? what does it do? a joke?
Re: Popular Chinese iOS apps compromised in malware attack
#59It's amazing how widespread this is, perhaps the biggest malware infection ever in sheer number of devices affected? The Xcode attack vector is evil genius.
So all these apps are transmitting user data (basic device information) to 'icloud-analysis.com' and no one notices for how long?
I wish there were better tools to monitor outbound traffic from our own devices, but I guess it's just too overwhelming how many different places our data is sent in an average day of browsing.
Re: Popular Chinese iOS apps compromised in malware attack
#60Earlier quoted context omitted.
A checksum can only tell you if the file is identical to another. Even if it did - you downloaded the file from untrusted location for a reason - you don't have access to original source. Checksums are useless if you don't have access to an alternative source.
Xcode.app includes a digital signature, which can be checked with `codesign`. As all OS X comes bundled with Apple's root certificate, one can check for the validity of that application by oneself without any additional trusted source. Or if the developers never disable GateKeeper and read the warning, they will know that the application is not genuine.
Of course being China, of course Gatekeeper is totally disabled and no one has valid signatures on anything unless it's absolutely required