Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular Chinese iOS apps compromised in malware attack

zh.greatfire.org

Post reply on HN
Print view View original

61–70 of 89 posts

Re: Popular Chinese iOS apps compromised in malware attack

#61

Post by 4684499 »

flymoon wrote: post #58
swang75 wrote: post #57

The WeChat team posted a public bulletin 24 hours ago saying that their was no leaked user info and that the issue only affects WeChat 6.2.5 users on iOS and that newer versions are not affected. An English version was published several hours afterwards and can be found here: http://blog.wechat.com/2015/09/19/fixed-security-flaw-in-wec... Fixed Security Flaw in WeChat 6.2.5 for iOS A security flaw, caused by an exter…

The statement is controversy. It said WeChat 6.2.5 has been affected. But it also said no leaked user info. If it was affected, how do you know there is no leaking? if the flaw doesn't theft anything? what does it do? a joke?

Maybe a proof of concept? ;) https://twitter.com/bitinn/status/644941027023818753

Re: Popular Chinese iOS apps compromised in malware attack

#62

Post by stardust21 »

anti_spy_zzz wrote: post #13

What about Android? Can the same scheme happen to Eclipse and affect Android apps, too? Now, do we all switch to Windows phones?

Because Google is not available in China, so most of Android developers in big companies know how to cross the GFW, after crossing the CDN of Google will make the download very fast. So I think Android apps may be less effected under this situation.

Re: Popular Chinese iOS apps compromised in malware attack

#63

Post by Matt3o12_ »

zaroth wrote: post #59

It's amazing how widespread this is, perhaps the biggest malware infection ever in sheer number of devices affected? The Xcode attack vector is evil genius. So all these apps are transmitting user data (basic device information) to 'icloud-analysis.com' and no one notices for how long? I wish there were better tools to monitor outbound traffic from our own devices, but I guess it's just too overwhelming how many diff…

The best tool I've found so far is MITMProxy [1]. It lets you snoop all your HTTP(s) traffic from your iPhone. You just have to keep it running on your PC (or server, if you want) and set the HTTP Proxy settings accordingly. Then you have to install a CA certificate (that has been locally created and is only known by you). It is pretty interesting what data your phone is sending. Of course, you could simply trick this tool by not using HTTPS (and send it over FTP or a custom protocol instead) but it is a good start.

[1] https://mitmproxy.org/

Re: Popular Chinese iOS apps compromised in malware attack

#64

Post by ihsw »

superuser2 wrote: post #26

Remember the NSA's infamous "I hunt sysadmins" [1]. Software engineers, ops people, and sysadmins at big tech companies with interesting data are high-value targets. If you can can run code on production infrastructure or a large install base, you should assume you are being actively, personally targeted by multiple advanced persistent threats, including at least one state intelligence agency, and adjust your OPSEC a…

Not even that -- there are tech firms that have teams that span multiple geographic boundaries and spoken languages, and they have varying degrees of opsec (from none to excellent, with your typical bellcurve).

These firms receive contracts from Fortune 500 companies that have no interest in hiring/maintaining technical staff but have a need for apps that reach their userbase (of which numbers from hundreds of thousands to several millions across various jurisdictions).

The world of software development is growing and there are cracks appearing everywhere, a malicious individual should have no trouble accruing a healthy collection of exploitable code across various tech stacks (be it Android, iOS, server-side, or otherwise).

Proper opsec is expensive and many companies don't even bother (or are completely unaware that they could be in trouble), and that's not even touching on designing secure systems. A malicious individual could hold code for several months before deploying an exploit that reaches end-users.

Hunting sysadmins is most definitely a serious problem, but so is outsourcing.

Re: Popular Chinese iOS apps compromised in malware attack

#65

Post by coldtea »

cooleng wrote: post #52
bitinn wrote: post #50

Think only Chinese iOS Apps are affected? Think again, because your favorite app might just be outsourced to Chinese developers. Apps like Mercury, WinZip, PDFReader are reported to be affected by this Xcode trojan (have been taken down by Apple). http://researchcenter.paloaltonetworks.com/2015/09/malware-x...

IOS now is the most dangerous platform...

Not by a large margin.

First of all, it's not the platform. There wasn't some vulnerability found in iOS that made this possible.

It's caused by pirated infected third party XCode downloads. If you use third party Visual Studio or Eclipse/Idea for Android development, you can get the same exact issues.

Second, apps run in a sandbox in iOS anyway, so those infected apps can't do much besides giving you ads and data about their usage.

Thirds, that's like 100 apps in the list, mostly all made in China, and all by people with infected, non-official XCode.

Contrast with malware in Android landm which amounts to 97% of mobile malware: http://www.forbes.com/sites/gordonkelly/2014/03/24/report-97...

Re: Popular Chinese iOS apps compromised in malware attack

#66

Post by rahimnathwani »

mahyarm wrote: post #41
sigterm wrote: post #27

Earlier quoted context omitted.

It's bad when crossing the border. Rumor says it's due to traffic analysis by the GFW. I cannot find any source to prove or disprove that though.

The internet being bad is done on purpose. They don't have to make it shit with the traffic analysis, since internal traffic has traffic analysis too. They do it to keep china's internet an internal, more easily controllable intranet.

I think it has more to do with lack of competition in the ISP market. In most places, there's only one fixed line broadband provider, so there's incentive to increase speeds (as people will pay to get better quality streaming video on multiple devices) but none to improve peering with overseas networks.

Re: Popular Chinese iOS apps compromised in malware attack

#68

Post by [deleted] »

chvid wrote: post #40
chvid wrote: post #35

Earlier quoted context omitted.

I don't read Chinese but this reads very sensational. For example it says not to download WeChat at all while its sources seem to say it is only an older version that is affected. The sources seems to be tweet-like forum postings. Think about it. If Facebook had their releases infected by a virus - what would be needed to convince the world? It would either require Facebook to officially acknowledge it or have someon…

I can now see that the developers of WeChat Tencent have acknowledge that a release of theirs has been infected: http://security.tencent.com/index.php/blog/msg/96 Wrt. to this github: https://github.com/XcodeGhostSource/XcodeGhost As far as I can see what this code does is that it sends some basic user information to an external website and it may popup an alert window or open Safari or other apps based on the respon…

[deleted]

Re: Popular Chinese iOS apps compromised in malware attack

#69

Post by flymoon »

coldtea wrote: post #65
cooleng wrote: post #52

Earlier quoted context omitted.

IOS now is the most dangerous platform...

Not by a large margin. First of all, it's not the platform. There wasn't some vulnerability found in iOS that made this possible. It's caused by pirated infected third party XCode downloads. If you use third party Visual Studio or Eclipse/Idea for Android development, you can get the same exact issues. Second, apps run in a sandbox in iOS anyway, so those infected apps can't do much besides giving you ads and data ab…

Thanks for correcting me. I am wondering if IOS could add a new feature to detect bad apps.

For example IOS could give an operation history summary for each App. The list could be something like this:

APP1:

Photo ---- read ? times write ? times

Contact ---- ...

sms ---- ...

device ID ---- ...

APP2:

Photo ---- read ? times write ? times

Contact ---- ...

sms ---- ...

device ID ---- ...

customer can turn on/off this feature.

I believe if IOS have this feature, it will be much easier for IOS user to find out the bad APP.

Re: Popular Chinese iOS apps compromised in malware attack

#70

Post by myko »

coldtea wrote: post #65
cooleng wrote: post #52

Earlier quoted context omitted.

IOS now is the most dangerous platform...

Not by a large margin. First of all, it's not the platform. There wasn't some vulnerability found in iOS that made this possible. It's caused by pirated infected third party XCode downloads. If you use third party Visual Studio or Eclipse/Idea for Android development, you can get the same exact issues. Second, apps run in a sandbox in iOS anyway, so those infected apps can't do much besides giving you ads and data ab…

Which popular/mainstream Android apps were taken down from Google Play due to malware?

I'll grant you third party Android app stores and side loading is more dangerous than iOS - but in the case of Google Play vs iTunes it seems like Google Play is safer.

Post reply on HN