Apple Targeted as Malware Infects China Mobile Apps
Apple Targeted as Malware Infects China Mobile Apps
WeChat, Didi Kuaidi among dozens hit; breach of iOS
platform is called unusual
By JOSH CHIN Updated Sept. 20, 2015 8:18 p.m. ET
BEIJING—Some of the most popular Chinese names in Apple
Inc.’s App Store were found to be infected with malicious software in what is
being described as a first-of-its-kind security breach, exposing a rare
vulnerability in Apple’s mobile platform, according to multiple researchers.
The applications were infected after software developers
were lured into using an unauthorized and compromised version of Apple’s
developer tool kit, according to researchers at Alibaba Mobile Security, a
mobile antivirus division of Alibaba Group Holding Ltd.
The list of recently compromised iPhone and iPad apps
includes Tencent Holdings Ltd.’s popular mobile chat app WeChat, Uber-like
car-hailing app Didi Kuaidi, and a Spotify-like music app from Internet portal
NetEase Inc.
The attack affected more than three dozen apps, according
to U.S.-based cybersecurity firm Palo Alto Networks Inc.
The infected apps can transmit information about a user’s
device, prompt fake alerts that could be used to steal passwords to Apple’s
iCloud service, and read and write information on the user’s clipboard,
according to researchers.
Apple said in a late Sunday statement that it had taken
steps to address the problem. “To protect our customers, we’ve removed the apps
from the App Store that we know have been created with this counterfeit
software and we are working with the developers to make sure they’re using the
proper version of Xcode to rebuild their apps,” the statement said.
In separate statements posted to social media over the
weekend, Tencent, Didi Kuaidi Joint Co. and NetEase said their applications had
been compromised but said no sensitive customer information had been lost.
“At present, we haven’t discovered any loss of user
information or assets as a result of this [breach], though the WeChat team will
continue to monitor and do tests,” Tencent said in a note posted to the Sina
Weibo microblogging service late Friday. A new, clean update of the WeChat app
had been uploaded to the app store, it said.
‘We believe XcodeGhost is a very harmful and dangerous
malware that has bypassed Apple’s code review and made unprecedented attacks on
the iOS ecosystem’
—Palo Alto Networks security researcher Claud Xiao
It is unusual for malware to spread through Apple’s App
Store, which typically subjects apps to stringent reviews. In a blog post
Thursday, Palo Alto Networks said the attack was the first of its type directed
at Apple’s iOS mobile operating system. Chinese anticensorship activist group
Greatfire.org called it “the most widespread and significant spread of malware”
in the app store’s history.
Asked if it was possible the Chinese government was
involved, Palo Alto Networks said it didn’t yet have enough information to
determine who was behind the attack.
Other apps found infected with the malware include those
belonging to state-run mobile carrier China Unicom, and 12306, the country’s
official train-booking website, researchers said. China Unicom and China’s
railway bureau didn’t immediately respond to requests for comment Sunday.
It wasn’t clear Sunday how the infected apps made it past
Apple’s screening process, or whether the breach had resulted in any user
information being stolen, though researchers said millions of devices could
have been exposed based on the popularity of the apps in question.
WeChat has more than 500 million active users, according
to Tencent. It isn’t clear how many use devices from Apple, which accounts for
about 15% of China’s smartphone market, according to researcher IDC.
The hack exploited Chinese developers’ impatience,
according to Palo Alto Networks. To write apps for Apple devices, developers
have to use a tool kit called Xcode, but downloading the official version from
Apple’s website can take a long time in China.
The hackers posted their infected version on a Chinese
server, advertising faster downloads, the researchers said. Any app created or
altered using the bogus Xcode would then become infected with the malware, they
said.
The infected Xcode was hosted on Baidu Pan, a cloud
service offered by Chinese search company Baidu Inc., said multiple security
researchers.
Baidu removed the file shortly after being notified of
its existence, Baidu spokesman Kaiser Kuo said Sunday.
The malware has been dubbed XcodeGhost by Alibaba Mobile
Security researchers, who were the first to document it extensively in a series
of social-media posts starting Thursday.
Even if the hackers didn’t use the malware to steal
anything, Palo Alto Networks warned it still represented a threat to the
popular operating system. Security researcher Claud Xiao wrote on the firm’s
website Friday that criminals and spies could use the malware to gain access to
iOS devices.
“We believe XcodeGhost is a very harmful and dangerous
malware that has bypassed Apple’s code review and made unprecedented attacks on
the iOS ecosystem,” he wrote.
—Yang Jie and Danny Yadron contributed to this article.
Comments
Post a Comment