Apple Confirms Malware-Infected Apps Found And Removed From Its Chinese App Store

Apple has confirmed a security breach in its Chinese App Store which saw nearly forty popular applications infected with malware – a result of app developers being tricked into downloading a compromised version of Apple’s Xcode developer tool kit. The breach, first discovered by researchers at Alibaba Mobile Security, affected a number of popular apps in the region, including WeChat, Didi Kuaidi (an Uber-like service), business card scanning app CamCard, and several others.

According to U.S.-based security firm Palo Alto Networks, which refers to the malware as “XcodeGhost,” 39 iOS applications were affected. The malware could potentially impact hundreds of millions of users, the company said.

The breach was surprising, given Apple’s historically stringent app review policies. However, in this case, the malware authors capitalized on developers’ demand for Apple’s official Xcode software. A compromised version of the Xcode software was uploaded to Baidu’s cloud storage site, promising a faster download than the official version hosted on Apple’s own website, which is slowed due to China’s Great Firewall.

But to even install this affected version of the Xcode software, developers had to ignore a warning which indicated the software was damaged and should be moved to the trash:

In other words, Apple’s Gatekeeper technology, which prevents non-App Store and unsigned versions of programs, like Xcode, from being installed, was doing its job. Developers, however, ultimately chose to ignore the warnings and proceed to install and use the compromised software.

Then, when app developers used this version of Xcode to code their apps, their apps would then become infected with the malware. (Baidu has since taken down the infected software, it said.)

Palo Alto Networks explains in a blog post that the malicious code uploaded users’ device information and app information to the attackers’ command and control server, which allowed the users’ devices to then be able to receive instructions from the malware’s creator. Some of those instructions included a prompt that would be a fake alert that phished for user credentials; a way to hijack opening special website URLs, which would allow for further exploitation in the iOS system; and the ability to write and write data to the user’s clipboard which could be used to read the user’s password, in the case the password was copied from a password management tool.

One developer said that XcodeGhost had already launched phishing attacks aimed at acquiring users’ iCloud passwords, Palo Alto Networks noted.

It’s unclear who’s behind the attack at present, the security firm says, but it did indicate that the techniques used could be those that “criminal and espionage groups” would use to gain access to iOS devices.