The heck looks pretty scary. But what if I don't use gmail app on my iPhone? Of course I don't ever click on those kind of strange links anyways...
Gmail was just the example for demonstration purposes. It could be any non-standard Apple app.
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
'Masque Attack' Vulnerability Allows Malicious Third-Party iOS Apps to Masquerade as Legitimate Apps
- Thread starter MacRumors
- Start date
- Sort by reaction score
Gmail was just the example for demonstration purposes. It could be any non-standard Apple app.
I know personally I have clicked links to apps to download that redirect to the app store. macrumors.com, and almost every tech blog all do app links. Some of you guys act like it would have to be from some seedy obvious link, when it could be from a website.
We just had an article saying iOS was like 60% of phone activations in businesses, right? Some companies could use that to steal datas from competitors, or stuff like that.
Yes this is a pretty bad vulnerability, maybe it doesn't affect everyone (obviously not since you need provisioning profiles and stuff like that installed). Like, just make gmail or any other app crash.
The average user would delete it and reload it, but the malicious code would have been executed without the user even knowing something bad happened.
(But hey, since people seem to be obsessed with China/NSA, maybe they used that thing for years to steal all our datazz
This is a phishing type vulnerability. The vulnerability is more in the total idiocy of the people receiving those things.
It probably needs a fix, but one that will keep the original delivery channel they're using mostly intact.
Restricting this too tightly will create side problems since they are using a legitimate way to get in.
People authorizing malware installation on their desktops are the same.
If it comes from a website you trust, that website would also need to be compromised; that's a major effort just to get into a few phones. If a major web site is compromised, the hackers probably can get you in many other ways without even having to get to your phone directly... Say skimming your passwords and then getting into all your other accounts all over the internet
.That has nothing to do with this issue. The link isn't taking you to an app store. The user isn't browsing a 3rd party store. They are clicking a link and having it install over an existing app.
It's interesting that this doesn't work for stock Apple apps... why not? What's different about the stock apps from third-party apps? Aren't they all protected by the same mechanisms?
So what you are saying is people click on links without thinking. It's good that it's always the fault of someone else and not the actual person who doesn't think. I would bet these are the same people that use password as their password. I'm not saying it shouldn't be fixed, perhaps Apple needs to prevent ALL sideloading.
They can't access the secure element even if they had root, which they wouldn't even have in this case. All pins are entered with Apple's keyboard so there is no way to skim them. If you access your own bank through their app, that would be dangerous; but it has nothing to do with Apple pay.
If I'm using a non-enterprise ios device --- just a regular old iphone from the carrier, will it be able to install this rogue app also?
You seem to think the attacker can't replace the link text with "click here to win a prize" ...
I'd be willing to bet ten times more young people would click on such a link and load malware than would 'old people'.
My instincts are telling mr that they will find a way, but I hope you are right at least for now.
For one, stock apps are kept in /Applications, and store apps are in /var/mobile/Applications.
Hmmm, these malicious users are crafty and must really have time on there hands to come up with these workarounds.
Still, I delete spam messages, don't open strange emails, and never click ads on any webpage so I'll roll the dice and keep using my iOS devices.
You don't need to click ads for the App Store to launch. It happens to me regularly.
It's not hard for someone to build a pop-up web page to look like the App Store. People could easily think it is the App Store anyway since apple allows safari and ads in apps to launch the actual App Store to a particular app without any user action at all.
Too stupid for their own good and idiots. Hmmm. Do you kiss your wife with that mouth?
just kidding. Not every person is an IT guru. Fact is the majority of the public isn't overly tech savvy. Moreover, even those who consider themselves tech savvy, and read tech forums, may not know everything you think an idiot should know. Examples below of tech savvy people who are not idiots, but don't know everything. We all can't be OldSchoolMacGuy.You're "old school" MR. Surprised you resorted to Yahoo/Facebook level commentary. Idiots and stupid.
Apologies to you all for using your quotes as examples of tech savvy people who don't know everything. In no way am I equating any of you with idiot or stupid.
Can the pop-up (asking the user to install the app) be somehow circumvented or bypassed by the attacker automatically?
That would be truly scary.
If I understood correctly, the user at least needs to manually click "Install" after following the malicious link (?).
That would be truly scary.
If I understood correctly, the user at least needs to manually click "Install" after following the malicious link (?).
Unfortunately it seems that for the most part things have changed in iOS 8 in relation to profiles: in many instances you don't get prompted to install them and don't even see them on the device itself: http://stackoverflow.com/questions/...eta-4-xcode-6-beta-4#comment41038167_25132712
(I've dealt with this directly when I installed a beta of an app I was helping to test, where there was no prompt to install a profile and there was no way to remove it from the device short of going to Xcode and digging in there and trying to remove it from there.)
Except, this "hack" requires you to install enterprise provisioning first and then click on a link from a SMS/email. And THEN click on the install app popup. And THEN realize that the app that you just went to install, isn't there. And THEN just forget about it.
Seems like a simple thing, doesn't it?