obviously to monitor and crush dissent
Popular Chinese iOS apps compromised in malware attack
31–40 of 89 posts
Re: Popular Chinese iOS apps compromised in malware attack
#32Earlier quoted context omitted.
Did you read the article? This isn't a company intentionally mining user data, which is usually not criminal, as the EULA would have allowed those companies to do so. This is developers downloading Xcode from third-party sources, which are compromised and would inject third-party code to iOS apps sending analytics to a third-party server, without knowledge of the original developer.
What sort of analytics? Apple has blocked most of them. Why not just create some flashlight apps?
According to the posted source (if that's the actual one) it is just basic stuff.
But being able to inject code like that, as the article describes, could present fake login windows and whatnot for phishing attacks.
Re: Popular Chinese iOS apps compromised in malware attack
#33Tencent security team just posted a write-up on this issue on its blog. http://security.tencent.com/index.php/blog/msg/96
Here's the English translation:
---
Sep 12 - When we were tracking down a bug, we discovered that there was suspicious encrypted traffic sent from one/some app(s) to one/some particular domain(s) when the app(s) was/were launched or closed. Front-end security team immediately followed the issue.
Sep 13 - Tencent product team released an updated version of the app(s). We notified CNCERT of the issue.
Sep 14 - CNCERT issued a pre-warning on its website. [1]
Sep 16 - We discovered that 76 of the top 5000 apps on App Store were infected. We notified Apple and most of the app vendors of the infected apps of the issue.
Sep 17 - Palo Alto Networks also discovered the issue and published a report of their preliminary findings[2], and so did Ali mobile security team[3].
Analysis
1. Infected apps send the following information to attackers' servers: app name, app version, iOS version, locale, device type, country code, IDFV. The domain used is icloud-analysis.com. We also discovered three other domains that are not used.
2. Attackers can identify every infected iOS device and issue commands to be executed via the openURL API.
3. Attackers can invoke a customized alert box on infected iOS devices, showing whatever they want.
4. The malicious remote control module itself is vulnerable to MiTM attack.
It should be noted that multiple versions of the remote control module are discovered, some of which do not have the capability described in (2) and (3).
[1] http://www.cert.org.cn/publish/main/12/2015/2015091415282115...
[2] http://researchcenter.paloaltonetworks.com/2015/09/novel-mal...
[3] http://drops.wooyun.org/news/8864 (Chinese)
Re: Popular Chinese iOS apps compromised in malware attack
#34Update: it may be able to steal iCloud passwords:
http://researchcenter.paloaltonetworks.com/2015/09/update-xc...
Re: Popular Chinese iOS apps compromised in malware attack
#35Really? So the developers of wechat had their xcode infected by something and now an unauthorized tracker is on the ios wechat app?! Wechat with about 500 mio users! Probably running on about 90% of Chinese-owned iPhones. I would like to see some independent confirmation of that.
It's true and if you read Chinese, it is already all over the Internet. On twitter, most of them are under #XcodeGhost[0]. Besides, the (alleged) author has put the source code on github[1]. 0. https://twitter.com/hashtag/XcodeGhost?src=hash 1. https://github.com/XcodeGhostSource/XcodeGhost Update 1: Add the source code of XcodeGhost
I don't read Chinese but this reads very sensational. For example it says not to download WeChat at all while its sources seem to say it is only an older version that is affected.
The sources seems to be tweet-like forum postings.
Think about it. If Facebook had their releases infected by a virus - what would be needed to convince the world?
It would either require Facebook to officially acknowledge it or have someone do an explicit reproducable analysis of a release.
I.e. this particular version 6.23 of Messenger, signed by Facebook, that you can download here, does sends user information, under these circumstances, to this address which it is clearly not a part of Facebook but belongs to this malicious compiler virus.
Re: Popular Chinese iOS apps compromised in malware attack
#36 Heh I think these malware writers were involved in the development of Windows10 as well
Re: Popular Chinese iOS apps compromised in malware attack
#37The internet in China is so bad developers at Tencent download Xcode from random links on Chinese Dropbox? Pathetic.
And dont run a checksum.
Re: Popular Chinese iOS apps compromised in malware attack
#38Earlier quoted context omitted.
It's true and if you read Chinese, it is already all over the Internet. On twitter, most of them are under #XcodeGhost[0]. Besides, the (alleged) author has put the source code on github[1]. 0. https://twitter.com/hashtag/XcodeGhost?src=hash 1. https://github.com/XcodeGhostSource/XcodeGhost Update 1: Add the source code of XcodeGhost
I don't read Chinese but this reads very sensational. For example it says not to download WeChat at all while its sources seem to say it is only an older version that is affected. The sources seems to be tweet-like forum postings. Think about it. If Facebook had their releases infected by a virus - what would be needed to convince the world? It would either require Facebook to officially acknowledge it or have someon…
[deleted]
Re: Popular Chinese iOS apps compromised in malware attack
#39> If you are an iOS developer, however, a lot can be done to secure your development system:... Separate your development system with your everyday system. Development systems should be used solely for development and not for browsing random sites. If physical separation presents too much of a problem for developers, at the very least, a dedicated user account for development should be used. I'm not an application de…
It's often good practice to have a dedicated build server responsible for producing your release builds and owning the release key. That machine should be kept as secure as possible, along with your source control server.
However, isolating machines used solely for development is not common. A leaked development key is typically not very useful. The resulting code is usually not run anywhere other than the developer's own hardware.
(A compromised dev machine in this scenario could still be used to push malicious code to source control, which would be bad. So it's still good to keep security in mind. But at least that's potentially detectable compared to a compromised compiler. This is also where mandatory code review prior to commit can be useful.)
Re: Popular Chinese iOS apps compromised in malware attack
#40Earlier quoted context omitted.
It's true and if you read Chinese, it is already all over the Internet. On twitter, most of them are under #XcodeGhost[0]. Besides, the (alleged) author has put the source code on github[1]. 0. https://twitter.com/hashtag/XcodeGhost?src=hash 1. https://github.com/XcodeGhostSource/XcodeGhost Update 1: Add the source code of XcodeGhost
I don't read Chinese but this reads very sensational. For example it says not to download WeChat at all while its sources seem to say it is only an older version that is affected. The sources seems to be tweet-like forum postings. Think about it. If Facebook had their releases infected by a virus - what would be needed to convince the world? It would either require Facebook to officially acknowledge it or have someon…
I can now see that the developers of WeChat Tencent have acknowledge that a release of theirs has been infected:
http://security.tencent.com/index.php/blog/msg/96
Wrt. to this github:
https://github.com/XcodeGhostSource/XcodeGhost
As far as I can see what this code does is that it sends some basic user information to an external website and it may popup an alert window or open Safari or other apps based on the response of that external website.
It is not a compiler virus and there is nothing on how you can modify an XCode release to add the above into other developers' apps.