{"id":3968,"date":"2015-09-24T23:43:02","date_gmt":"2015-09-24T15:43:02","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3968"},"modified":"2015-09-24T23:43:09","modified_gmt":"2015-09-24T15:43:09","slug":"xcodeghost-ios-trojan-infected-over-4000-apps","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2015\/09\/xcodeghost-ios-trojan-infected-over-4000-apps\/","title":{"rendered":"XcodeGhost iOS Trojan Infected Over 4000 Apps"},"content":{"rendered":"<p>So the recent XcodeGhost iOS Trojan Infection has escalated quickly, an initial estimate of 39 infected apps has rapidly increased to over 4000! <\/p>\n<p align=\"center\"><img decoding=\"async\" src=\"https:\/\/c1.staticflickr.com\/1\/699\/21492300890_03225c7d79.jpg\" alt=\"XcodeGhost iOS Infection Over 4000 Apps\" \/><\/p>\n<p>You can see the FireEye announcement here: <a href=\"http:\/\/www.theregister.co.uk\/2015\/09\/23\/xcodeghost_ios_app_infection_toll_rises_to_four_thousand\/\">Protecting Our Customers from XcodeGhost<\/a><\/p>\n<p>XCodeGhost is the first instance of the iOS App Store distributing a large number of trojanized apps, the malicious\/infected apps steal device and user information and send stolen data to a command and control (CnC) server<\/p>\n<blockquote><p>The number of XCodeGhost-infected iOS apps, initially pegged at 39, has ballooned to more than 4,000.<\/p>\n<p>The staggering increase was the handiwork of analysis by FireEye researchers who said that the apps were being hosted on the official Apple App Store.<\/p>\n<p>&#8220;Immediately after learning of XcodeGhost, FireEye Labs identified more than 4,000 infected apps on the App Store,&#8221; FireEye said.<\/p>\n<p><em><strong>    The malicious apps steal device and user information and send stolen data to a command and control (CnC) server [and] also accept remote commands including the ability to open URLs sent by the CnC server.<\/p>\n<p>    These URLs can be phishing webpages for stealing credentials, or a link to an enterprise-signed malicious app that can be installed on non-jailbroken devices.<\/strong><\/em><\/p>\n<p>A FireEye spokesman told Vulture South that many of the infected apps were owned by &#8220;big Chinese global brands&#8221; such as consumer electronics, telcos, and banks.<\/p>\n<p>The Register has asked FireEye for the names of some of the prominent affected apps and will update this story should the information come to hand.<\/p>\n<p>FireEye put the huge increase in the number of discovered apps to fast scanning by its mobile threat prevention platform.<\/p><\/blockquote>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>It seems to be heavily linked to China, with the original XcodeGhost author also being Chinese, you can see the code repo here: <a href=\"https:\/\/github.com\/XcodeGhostSource\/XcodeGhost\">XcodeGhost<\/a><\/p>\n<p>A translation using Google sees the author apologise and say he wrote this as a personal experiment and the original only collects non-personal data like device type, iOS version, language, country, device name and so on.<\/p>\n<blockquote><p>Apple has continued to exorcise the App Store of malicious apps uploaded in what has been widely considered to be Cupertino&#8217;s first big malware attack.<\/p>\n<p>The apps were infected after developers downloaded a copy of the Xcode iOS development tool through a file-sharing service. That package was modified to trojanise apps in a way that passed App Store security checks, and was advertised on popular developer forums as a faster source to download the 3Gb Xcode file.<\/p>\n<p>The success of the XCodeGhost phish is staggering; that some 4,000 apps were hosed indicates that a lot of developers were sucked into what must have been a very well-executed attack by highly capable malefactors.<\/p>\n<p>Veracode principal solutions architect John Smith said that the attack challenged the notion that iOS was safer than Android.<\/p>\n<p>&#8220;In recent years it has seemed that the problem of mobile malware was bigger for Android than for iOS,&#8221; Smith said.<\/p>\n<p>&#8220;The more rigorous testing regime required before an iOS app can be published has always been considered to be the reason for this difference, but in this case it seems to have fallen short.&#8221; <\/p><\/blockquote>\n<p>From an infection graph, it seems like it&#8217;s been going on for a while, since April 2015 at least &#8211; but there&#8217;s been a <a href=\"http:\/\/arstechnica.com\/security\/2015\/09\/xcodeghost-apps-haunting-ios-app-store-more-numerous-than-first-reported\/\">huge peak in infected apps in September<\/a>.<\/p>\n<p>It&#8217;s surprising that such a large number of apps were able to violate Apple&#8217;s stringent App Store policies for such an extended period of time.<\/p>\n<p>Even then, it seems like the implementation of XcodeGhost isn&#8217;t that malicious and they aren&#8217;t sending much more than the original author intended.<\/p>\n<p>Source: <a href=\"http:\/\/www.theregister.co.uk\/2015\/09\/23\/xcodeghost_ios_app_infection_toll_rises_to_four_thousand\/\">The Register<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>So the recent XcodeGhost iOS Trojan Infection has escalated quickly, an initial estimate of 39 infected apps has rapidly increased to over 4000! You can see the FireEye announcement here: Protecting Our Customers from XcodeGhost XCodeGhost is the first instance of the iOS App Store distributing a large number of trojanized apps, the malicious\/infected apps [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"So the recent XCodeGhost iOS Trojan Infection has escalated quickly, an initial estimate of 39 infected apps has rapidly increased to over 4000!","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[18,10,7],"tags":[103,6066,6065],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3968"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3968"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3968\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3968"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3968"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3968"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}