71–80 of 89 posts
Was it something that's injected at compile time (the Xcode building the app store version was compromised for all these apps?)? Was it just files added to the project if anyone on the team used the compromised Xcode?
What about Android? Can the same scheme happen to Eclipse and affect Android apps, too? Now, do we all switch to Windows phones?
Because Google is not available in China, so most of Android developers in big companies know how to cross the GFW, after crossing the CDN of Google will make the download very fast. So I think Android apps may be less effected under this situation.
Earlier quoted context omitted.
Not by a large margin. First of all, it's not the platform. There wasn't some vulnerability found in iOS that made this possible. It's caused by pirated infected third party XCode downloads. If you use third party Visual Studio or Eclipse/Idea for Android development, you can get the same exact issues. Second, apps run in a sandbox in iOS anyway, so those infected apps can't do much besides giving you ads and data ab…
Thanks for correcting me. I am wondering if IOS could add a new feature to detect bad apps. For example IOS could give an operation history summary for each App. The list could be something like this: APP1: Photo ---- read ? times write ? times Contact ---- ... sms ---- ... device ID ---- ... APP2: Photo ---- read ? times write ? times Contact ---- ... sms ---- ... device ID ---- ... customer can turn on/off this fea…
I think Apple can add such as a step into their build process (IIRC, with the new XCode 7 there's the option to submit a kind of bytecode to be built on Apple's servers depending on the target architecture etc).
Another thing they could do is enable some kind of "Little Snitch"-like network connection that a user can enable for apps. This way the user can be informed for any "mysterious" external connections going on.
Earlier quoted context omitted.
Not by a large margin. First of all, it's not the platform. There wasn't some vulnerability found in iOS that made this possible. It's caused by pirated infected third party XCode downloads. If you use third party Visual Studio or Eclipse/Idea for Android development, you can get the same exact issues. Second, apps run in a sandbox in iOS anyway, so those infected apps can't do much besides giving you ads and data ab…
Which popular/mainstream Android apps were taken down from Google Play due to malware? I'll grant you third party Android app stores and side loading is more dangerous than iOS - but in the case of Google Play vs iTunes it seems like Google Play is safer.
Well, there have been popular apps that have been infected as came pre-installed in phones:
http://thehackernews.com/2015/09/android-smartphone-malware....
As well as apps pulled from Google Play for having malware:
http://www.huffingtonpost.com/2015/02/04/mobile-malware_n_66...
http://www.coindesk.com/google-pulls-six-mobile-wallpaper-ap...
Earlier quoted context omitted.
IOS now is the most dangerous platform...
Not by a large margin. First of all, it's not the platform. There wasn't some vulnerability found in iOS that made this possible. It's caused by pirated infected third party XCode downloads. If you use third party Visual Studio or Eclipse/Idea for Android development, you can get the same exact issues. Second, apps run in a sandbox in iOS anyway, so those infected apps can't do much besides giving you ads and data ab…
It is well-known that due to Apple's restrictions on third-parties scanning software in their store, malware incidences in the App Store are significantly underreported.
Earlier quoted context omitted.
I don't read Chinese but this reads very sensational. For example it says not to download WeChat at all while its sources seem to say it is only an older version that is affected. The sources seems to be tweet-like forum postings. Think about it. If Facebook had their releases infected by a virus - what would be needed to convince the world? It would either require Facebook to officially acknowledge it or have someon…
I can now see that the developers of WeChat Tencent have acknowledge that a release of theirs has been infected: http://security.tencent.com/index.php/blog/msg/96 Wrt. to this github: https://github.com/XcodeGhostSource/XcodeGhost As far as I can see what this code does is that it sends some basic user information to an external website and it may popup an alert window or open Safari or other apps based on the respon…
Nobody said it was. Modifying a compiler to inject XcodeGhost is simple assembly work. Almost anyone could figure it out in an afternoon.
Multiple independent security organizations are reporting that the modified XCode release was shared via a filesharing site in China. That is how so many Chinese iOS developers came across it.
The version of XcodeGhost on github is a harmless version posted by the original author. The actual compiled code being found in the wild has malicious abilities not found in the code in that GitHub repo.
Earlier quoted context omitted.
Which popular/mainstream Android apps were taken down from Google Play due to malware? I'll grant you third party Android app stores and side loading is more dangerous than iOS - but in the case of Google Play vs iTunes it seems like Google Play is safer.
> Which popular/mainstream Android apps were taken down from Google Play due to malware? Well, there have been popular apps that have been infected as came pre-installed in phones: http://thehackernews.com/2015/09/android-smartphone-malware.... As well as apps pulled from Google Play for having malware: http://www.huffingtonpost.com/2015/02/04/mobile-malware_n_66... http://www.coindesk.com/google-pulls-six-mobile-wal…
The internet in China is so bad developers at Tencent download Xcode from random links on Chinese Dropbox? Pathetic.
It's bad when crossing the border. Rumor says it's due to traffic analysis by the GFW. I cannot find any source to prove or disprove that though.
Data localisation regulations are certainly one reason for foreign companies to set up local infra, but IMHO the real reason is that it's the only way to provide an even remotely tolerable user experience to users in mainland China. Aliyun is basically AWS for China and is very easy to get up and running, and getting an ICP license wasn't nearly as hard as everyone makes it out to be (got one in ~2 weeks from application).
I find it interesting that the source code on GitHub was committed by 2 different users with the same user name XcodeGhostSource, one for the code and one for the README.md. Are these two separate persons? Or maybe the one for the code was committed before using the same email to register GitHub account? https://github.com/XcodeGhostSource/XcodeGhost/commits/maste...
Different email address it seems. https://github.com/XcodeGhostSource/XcodeGhost/commit/e5b527... https://github.com/XcodeGhostSource/XcodeGhost/commit/014f78...
Remember the NSA's infamous "I hunt sysadmins" [1]. Software engineers, ops people, and sysadmins at big tech companies with interesting data are high-value targets. If you can can run code on production infrastructure or a large install base, you should assume you are being actively, personally targeted by multiple advanced persistent threats, including at least one state intelligence agency, and adjust your OPSEC a…
To give some practically implementable advice, what you should do is run anything that parses untrusted input in a virtual machine or physically separate machine. This means you should browse the web, read e-mail and read any Office/PDF/whatever files sent to you in a virtual machine that doesn't have access to anything more than strictly needed. The reason is that most desktop software and OS kernels are not written…
I keep reading (IMO nonsense) that best practices like those compliance frameworks aren't enough (mostly coming from Josh Corman). However, breaches are the on the rise and only 10% of the IT industry is goes through this thorough cleansing process.
Security Compliance forces you to go through that cleansing. This isn't a compliance burden, its just thorough hygiene.
Key Rotation process, Log Review process, Change control process, etc are examples of things in Compliance Frameworks.
Even the Chinese government is demanding that US Tech firms go through one of the above compliance programs.
http://www.nytimes.com/2015/09/17/technology/china-tries-to-...
Sysadmins continuously foo foo that compliance is not security.
They foo foo on it because they're self-compliant - doing security processes right the first time around. Therefore those self-compliant sysadmins are already security competent and don't need to adhere to an external set of security compliance standards.