Apple Responds to 'Masque Attack' Vulnerability, Not Aware of Customers Affected by Attack

[MacRumors]

Just a couple days after the discovery of an iOS vulnerability referred to as Masque Attack because of its ability to emulate and replace existing legitimate apps with malicious ones, Apple has responded in a statement to iMore. 

"We designed OS X and iOS with built-in security safeguards to help protect customers and warn them before installing potentially malicious software," an Apple spokesperson told iMore. "We're not aware of any customers that have actually been affected by this attack. We encourage customers to only download from trusted sources like the App Store and to pay attention to any warnings as they download apps. Enterprise users installing custom apps should install apps from their company's secure website."

Masque Attack works by luring a user to install an app outside of the iOS App Store by clicking a phishing link in a text message or email. For example, a user could be prompted to download a new app in a text message that says something like "Hey, try out Flappy Bird 2". A user is then directed to a website where they're prompted to download the app, which will install the fake app over the legitimate one using iOS enterprise provision profiles, making it virtually undetectable.

Masque Attack in action​

Earlier today, the United States government issued a warning about Masque Attack to iOS users. The vulnerability was discovered just a week after reports of malware called WireLurker surfaced. WireLurker is able to attack iOS devices through OS X using a USB cable. Both vulnerabilities are unlikely to affect the average iOS user as long as Apple's security features are not bypassed.

Both WireLurker and Masque Attack can be avoided by staying away from suspicious apps and avoiding links that prompt users to install apps outside of Apple's App Stores.

Article Link: Apple Responds to 'Masque Attack' Vulnerability, Not Aware of Customers Affected by Attack

 

[farewelwilliams]

lol @ people downloading that NDS4iOS emulator.

 

[RobertMartens]

Love is a masquerade.

 

[theheadguy]

Quite honestly this has already run its course. Enough already.

 

[jreuschl]

This only happens on an iPhone that bends, which also Apple denies existence of.

Hey, couldh't help it!

 

[Col4bin]

Just don't tether your phone to your computer via cord. Go wireless.

 

[hlfway2anywhere]

why is being able to install faked apps on iPhone considered a vulnerability, when on every other OS the same thing could happen and they call it "open."

 

[proline]

Quite honestly this has already run its course. Enough already.

Indeed. Count on MR to run a sensational story about a trivial threat. After all, gotta get those ad impressions!

 

[bozzykid]

why is being able to install faked apps on iPhone considered a vulnerability, when on every other OS the same thing could happen and they call it "open."

Because the apps replace an app that is already on the phone that is signed by a different developer. My guess is Apple is doing their usual "there is nothing to see here", while they are working to fix the issue as quietly as possible.

 

[Rigby]

why is being able to install faked apps on iPhone considered a vulnerability, when on every other OS the same thing could happen and they call it "open."

Because Apple always claims that their "closed" system is more secure than those others due to the review process?

Frankly, I don't understand why some people on this forum keep downplaying these security flaws. Perhaps they think they need to "defend" Apple, but that is misguided IMO. The "fappening" made it very obvious that Apple doesn't necessarily act to improve their security policies without public pressure. If that hadn't happended, we'd probably still have the weak iCloud security policy and incomplete 2-factor authentication. Public attention can only help to make the system more secure for everyone by forcing Apple to act.

 

[dannyyankou]

This is a less risky "vulnerability" than a fake bank email phishing your account information.

 

[ulyssesric]

This is my two cents.

Apple should ramp up the security level against Apps deployed with enterprise provision. They can effectively block any potential attacks like Wirelurker and Masque, by sandboxing the install packages of provision Apps within another sandbox: the AppStore.app.

They can add a new tab in App Store called "Enterprise." This tab is hidden by default, and becomes visible only after provision Apps being installed. All apps inserted from 3rd. party sources shall be isolated within this tab.

For example, any URL that is recognized as an IPA package shall be passed from Safari.app to AppStore.app. AppStore.app shall download the package and extract necessary identities such as bundle ID, title, icon, developer identity, and provision profile, before the package is actually installed.

When an IPA package is ready to install, users shall first click the package in "Enterprise" tab. A confirmation dialog with detailed informations shall be displayed, and users can decide whether to trust the package. If any conflict (other Apps with identical bundle ID) exists, users shall be asked for further confirmation to overwrite the old data.

This approach is unnecessary for those who aware the danger of unidentified internet resource, and it will not stop those who insist to shoot themselves in the foot either. But this would be very helpful for the rest of users who have little awareness of computer security. By adding an extra step and binding the whole thing within AppStore.app, it should be fairly effective to alter these users, and make them to think twice before clicking the "Trust" button.

 

[spectrumfox]

Quite honestly this has already run its course. Enough already.

Indeed. Count on MR to run a sensational story about a trivial threat. After all, gotta get those ad impressions!

It'll have run its course when Apple fixes the problem. You should not expect or want any less.

 

[locust76]

lol @ people downloading that NDS4iOS emulator.

Why?

 

[BvizioN]

This only happens on an iPhone that bends, which also Apple denies existence of.

Hey, couldh't help it!

You love that myth, don't you?

 

[CFreymarc]

Summary, "The cheap bastards that can't buy from our store deserve it."

 

[SolarShane]

lol @ people downloading that NDS4iOS emulator.

Why is that funny?

 

[pdaholic]

Tried out Flappy Bird Two.
Had my bank account cleaned out.
High score still only 2.

 

[SolarShane]

Wow. Everyone is looking past this subtle part of Apple's response:

"We encourage customers to only download from trusted sources like the App Store"

Hope this doesn't mean the closing of OS X!

 

[WardC]

Apple wants all the gold nuggets in their own Sandbox, theirs...and only theirs!!

 

[lincolntran]

Because Apple always claims that their "closed" system is more secure than those others due to the review process?

Frankly, I don't understand why some people on this forum keep downplaying these security flaws. Perhaps they think they need to "defend" Apple, but that is misguided IMO. The "fappening" made it very obvious that Apple doesn't necessarily act to improve their security policies without public pressure. If that hadn't happended, we'd probably still have the weak iCloud security policy and incomplete 2-factor authentication. Public attention can only help to make the system more secure for everyone by forcing Apple to act.

While this is a legitimate issue, it's not specific to ONLY iOS. It is a phishing trick than any software can run in to on any system. If Apple fixes this, i'm impress since this is still and issue on every other system. You still get warning emails from your IT guys for not clicking on strange links, dont you? You can't fix stupid (ignore warnings) or greed (free apps).

I think people who are defending Apple is trying to get this point across. there're multitude of apple haters that are trying to make this an iOS issue only hence the need to counter their point. Beside , there's nothing wrong with defending a product/brand than you like, not that they need defending.

 

[WardC]

Adobe Photoshop? Microsoft Office for OS X? Are these gold standards available on the Mac App Store?

I don't think so...and to install them you have to break security code and change your settings, and allow untrusted installs...

Oh no! Apple doesn't want you installing these evil programs. They want you to use only Pixelmator and Pages...

Right...

 

[RodThePlod]

Apple:

"You're downloading it wrong."

 

[WardC]

Don't get me wrong...I have Pixelmator and Pages and think they are great apps...but I still have the need for Photoshop and Microsoft Word, and think many Mac users in both graphics and the business world have an imperative necessity for these programs. Microsoft Word and Excel files are still the standard throughout the business world and even in most Universities today. I think Apple is trying too hard to promote their own App Store agenda by integrating this Sandboxing feature into every shipping copy of OS X today...

It is a self-serving agenda at that...and it's $$$ driven more than solely security focused, in my opinion.

 

[pietrov]

What I like more is
"download from trusted sources like the App Store and to pay"
ah, gosh, there is also "attention"...