How malware finally infected Apple iOS apps: XCodeGhost

[Ilya]

Google's open approach to Android apps have led to several malware issues over the past few years, while Apple users have remained relatively unscathed. Not any more. At least 39 apps installed by several hundred million iPad and iPhone owners include malware, acccording to Forbes.

The initial issue report came from Palo Alto Networks last week, noting that hackers took a unique approach to inject malware into iOS apps.

Since it's a challenge to get malware past Apple's App Store review team, hackers took a more indirect way: By adding the rogue code into what app developers thought was the official Apple version of XCode, Apple's IDE for creating iOS and Mac OS X apps.
...

Known infected apps include WeChat, PDF Reader, WinZip, Pocket Scanner, CamCard, and many other China-specfic titles. Palo Alto Networks says it is working with Apple to help mitigate the issue.

Source: http://www.zdnet.com/article/how-malware-finally-infected-apple-ios-apps-xcodeghost/

 

[Foxbat]

"...what app developers thought was the official Apple version of Xcode..." which means they did not get the Apple Developer kit from Apple. Sounds like Apple needs to ratchet its review process up a few notches to reject anything that isn't built with their Xcode.

 

[Ilya]

Apple will certainly have to do something about that, but it's easier said than done. Currently the only thing being certified is the binary file. It may not be easy to prove that it was built with legitimate XCode.