Got a tip for us? Share it...

Windows Malware Stows a Ride in iOS App Store App

CNET reports on the discovery of Windows malware embedded within an iPhone application available through the App Store. But rather than a directed attack at Windows users, the malware appears to have been accidentally included from an infected developer's system. The malware is also relatively old and easily detected by most antivirus software for Windows once the App Store package has been unwrapped.

The malware was first discovered by a user posting in the Apple support forums who noted that a download of Instaquotes-Quotes Cards For Instagram from developer Ilyas Hassani triggered warnings from the ClamXav antivirus software for Mac. While the Windows malware obviously could not harm the user's OS X installation, it was flagged as an infected file posing a danger to Windows systems. After learning about the discovery, CNET performed additional testing on the download to confirm that it was not a false positive.
Since the downloaded .ipa file is a package, these executables could be extracted using the package manager Pacifist, and then more accurately scanned. Afterward, other malware programs like Sophos that initially missed detecting the malware instantly picked it up and described it as "Mal/CoiDung-A," a worm written in visual basic that installs files within the Windows system directory and then modifies the Windows registry to execute the malware when the system is restarted.

Copying the malware to a Windows virtual machine running the latest version of Microsoft Security Essentials resulted in the malware being immediately detected and removed from the system.
It is unclear exactly how or why the malware came to be included in the App Store package, but it seems almost certain to have been an accidental inclusion. As delivered inside the application package, it appears to pose no harm to Windows users, who would have to decompress the package and manually run the infected file in order to expose themselves to the malware.

The infected application debuted in the App Store on July 19 and is currently still available for download after a temporary price drop from $0.99 to free over the weekend.

Top Rated Comments

(View all)

Posted: 28 months ago
This serves as a reminder that antivirus software for Mac (and Linux) is primarily for stopping the spread of Windows viruses.
Rating: 16 Votes
Posted: 28 months ago
Get a Mac!!!


I keep reading that Windows doesn't collect virus anymore yet continually I see the
ramifications of believing this.
Rating: 13 Votes
Posted: 28 months ago
I have to admit I'm more curious than concerned. I thought app development had to be done in X-Code, which only runs on a Mac. If so, the coding and work had to be done on a Mac. That being the case, how would Windows malware, even acidentally, end up in the app itself?

Obviously, I'm not a developer, so I'm sure I'm missing something, just curious as to what...
Rating: 7 Votes
Posted: 28 months ago
I am just curious how that happens? The only thing I can think of is that he has BootCamp or something with software to open up mac folder system on Windows. Because, even if the exe filed came on the mac side, it wouldn't be able to replicate itself or put itself into any random folders.

Then, why choose that particular folder? It isn't showing up in every folder path. Even if he says it wasn't deliberate, is it possible to get there, and only there, without it being on purpose?
Rating: 4 Votes
Posted: 28 months ago



EDIT: Ahhh crap!! :(


This is pathetic. :D

Anyway will this affect Windows machines with no antivirus software installed?
Rating: 3 Votes
Posted: 28 months ago

This is pathetic. :D

Anyway will this affect Windows machines with no antivirus software installed?


doesn't seem like it, unless you specifically open the ipa package and run the file. which you would have no reason to do.

arn
Rating: 3 Votes
Posted: 28 months ago
Sounds like Apple should run a virus check on App Store packages before approving them!

But .ipa files are not packages, as the article indicates, they're just renamed ZIP files. Pacifist should not be necessary to open them; just rename the file to something.zip and double click it.
Rating: 3 Votes
Posted: 28 months ago
It is very suspicious how it bundled itself in an .ipa file.
Windows viruses usually attach to Windows files known to be executables or have vulnerabilities that allow it to execute.
An .ipa file is totally foreign to Windows, and the locations where the virus installed itself are too much to be a mere coincidence.
Weird... just weird...
Rating: 3 Votes
Posted: 28 months ago
Even if it sounds like there is no way the malware would do harm unless you went out of your way poking into things, it still concerns me that something like this could be distributed in an app on the App Store. Doesn't Apple scan submissions for malware? I know they can't manually review every single update to every single app, but I would think they'd have the means to have their servers do a quick scan of what's in the app before it goes live. If they don't do this, maybe they should consider doing so now.
Rating: 2 Votes
Posted: 28 months ago

Get a Mac!!!


I keep reading that Windows doesn't collect virus anymore yet continually I see the
ramifications of believing this.


1. Mac runs Windows (and some people just have to use it for various reasons)
2. Windows detects it when unpacked (and if not unpacked, it's not a threat)
3. It doesn't do anything just being in that App

So, to your second sentence: In this case it stands true, Windows doesn't collect this virus. It gets removed automatically. ;)

PS: The only program which reminds me of running like there is a virus involved is iTunes! I see 6 cores on 20% doing something and iTunes is frozen for 3 minutes or so. All in a sudden, it runs again normally. Maybe they need to work on the database handling? I have only about 400-500 Apps and 4GB of music - it should be able to handle that. Especially because it could load all of that into the RAM but RAM is not really used for anything by iTunes.
Rating: 2 Votes

[ Read All Comments ]