Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
What You Need to Know About iOS Malware XcodeGhost
- Thread starter MacRumors
- Start date
- Sort by reaction score
You have no idea how slow it is to download it from the mac app store in China. But I'm not sure if it is because of GFW or Apple's server distribution.
I have been in China for quite some time and Apple server is not slow here. I get good speed of 9 mbps from Apple. Slow speed is an excuse from the application developers.
Thank you guys for posting such a detailed report about this. Im seriously impressed. I wouldnt have known where to turn to find this info. Props.
Earlier this week, Chinese developers disclosed new iOS malware called XcodeGhost on microblogging service Sina Weibo. U.S. cybersecurity firm Palo Alto Networks has since published details about the malware.
MacRumors has created a FAQ so you can learn more about XcodeGhost and how to keep your iOS devices protected.
What is XcodeGhost?
XcodeGhost is a new iOS malware arising from a malicious version of Xcode, Apple's official tool for developing iOS and OS X apps.
How is XcodeGhost distributed?
A malicious version of Xcode was uploaded to Chinese cloud file sharing service Baidu and downloaded by some iOS developers in China.
Chinese developers then unknowingly compiled iOS apps using the modified Xcode IDE and distributed those infected apps through the App Store.
Those apps then managed to pass through Apple's code review process, enabling iOS users to install or update the infected apps on their devices.
Which devices are affected?
iPhone, iPad and iPod touch models running an iOS version compatible with any of the infected apps. The malware affects both stock and jailbroken devices.
Which apps are affected?
Palo Alto Networks has shared a full list of over 50 infected iOS apps, including WeChat, NetEase Cloud Music, WinZip, Didi Chuxing, Railway 12306, China Unicom Mobile Office and Tonghuashun.
How many users are affected?
XcodeGhost potentially affects more than 500 million iOS users, primarily because messaging app WeChat is very popular in China and the Asia-Pacific region.
Which unofficial versions of Xcode are affected?
All unofficial versions between Xcode 6.1 and Xcode 6.4.
How does XcodeGhost put my iOS devices at risk?
iOS apps infected with XcodeGhost malware can and do collect information about devices and then encrypt and upload that data to command and control (C2) servers run by attackers through the HTTP protocol. The system and app information that can be collected includes:
Current time
Current infected app's name
The app's bundle identifier
Current device's name and type
Current system's language and country
Current device's UUID
Network type
Palo Alto Networks also discovered that infected iOS apps can receive commands from the attacker through the C2 server to perform the following actions:
Prompt a fake alert dialog to phish user credentials;
Hijack opening specific URLs based on their scheme, which could allow for exploitation of vulnerabilities in the iOS system or other iOS apps;
Read and write data in the user's clipboard, which could be used to read the user's password if that password is copied from a password management tool.
Can XcodeGhost affect users outside of China?
Yes. Some of the iOS apps infected with XcodeGhost malware are available on the App Store in countries outside of China. CamCard, for example, is a popular business card reader and scanner app available in the United States and several other countries, while WeChat is a popular messaging app in the Asia-Pacific region.
Why would some Chinese developers download Xcode from Baidu?
Xcode is a large file that can take a long time to download from Apple's servers in China, leading some developers to download Xcode from unofficial sources.
How are Apple and Chinese developers dealing with XcodeGhost?
Palo Alto Networks claims that it is cooperating with Apple on the issue, while multiple developers have updated their apps to remove the malware.
Apple has since issued the following statement to Reuters:How do I protect myself against XcodeGhost?
iOS users should immediately uninstall any infected iOS app listed here on their devices, or update to a newer version that has removed the malware. Resetting your iCloud password, and any other passwords inputted on your iOS device, is also strongly recommended as a precautionary measure.
Developers should install official versions of Xcode 7 or Xcode 7.1 beta from Apple's website for free and avoid downloading the software from unofficial sources.
Article Link: What You Need to Know About iOS Malware XcodeGhost
I don't care how slow it is. If it takes a week, you wait, because this is what happens when you take shortcuts. Maybe there's something Apple could or should be doing to speed up the process, but that's no excuse for downloading such critical software from an untrustable file-sharing site. It's absurdly stupid.
I would hope that Apple has Developers agree to ONLY use Apple's Developer Tools and any breaches such as this one should get the developer and all its ads suspended immediately. All users that downloaded any copies of the Developer's products should be notified of the problem with the developer.
You are blaming Apple for a Chinese firewall?
Yes, Apple has responsibilities, but not so much...
I did notice that....
CamCard is still in the store. This could be a hint that the app (this version) is not infected.
Downloading from Apple's servers in China actually isn't that slow. I'm in Xishuangbanna right now, and can get a solid 4 MB/s from Apple's servers on hotel Wi-Fi.
Lucky you, I had a holiday there back in 2001; beautiful part of the world! There was no hotel wifi then, I can tell you.
By the way, this baidu repository isn't some shady website. Baidu is the "Google" of China, although it's an impoverished, diseased, feeble minded man's version of Google.
Meaning it is shady. As long as it is behind the great firewall of China, it is suspect.
Thank you for the helpful info. I had the infected camcard on my iPhone. I've uninstalled it and also change my iCloud password. Just to be safe. So were clear, I don't to change any other passwords?
At some point, Mercury Web Browser stopped being updated on my iPhone, likely because of the change from iLegendSoft to Lucy Ding. From a twitter post I saw of the former, Lucy Ding is one of their employees. That (free) version of Mercury (9.1.0) is really cool (ad blocking, fast, print to PDF, bookmarks imports/exports, search in page, vertical scrollbar, and other goodies). It is no longer available on the App store because a newer (poorly reviewed) version has replaced it. How do we know whether that older version is safe? Apple really needs to provide some tool to check our older apps: don't know if it's possible but that would definitely help. I don't know what other browser out there offers the features I listed, this is really annoying!
I downloaded musical.ly when it hit popularity with the don't judge challenge? It was only used for about 10 minutes but I think it was installed for a day or two and hasn't been installed since. Am I still at risk even though it was months ago and I've recently upgraded to iOS 9?
I got the same thing, however, I believe it was tied to me resetting my iCloud password. Did you reset anything with your iCloud yet?
I think that this being the first malware apple has done a commendable job. It's the most used OS with a single version. Considering the hack it hardly collects any sensitive data at all and is a bit lame by malware standards!
There are some government peeps lining the pockets of top coders to make this version of x code and that's all they get. NSA must be pissed to be so locked out, they don't have these issues on Android though it's open season there.
There are some government peeps lining the pockets of top coders to make this version of x code and that's all they get. NSA must be pissed to be so locked out, they don't have these issues on Android though it's open season there.
Sorry, but you missed the entire point! The point is not the source of the malware, but that the malware infected apps got into the App Store - through Apple's quality control! - in the first place!
That's the point of the story!