Researchers Discover New 'WireLurker' Malware Affecting Macs and iOS Devices in China [Updated]

lightning_usb_cable_0_5_mResearchers from Palo Alto Networks (via The New York Times) have published a research paper on WireLurker, a malware new family that's been infecting both Mac OS and iOS systems over the course of the past six months. The researchers say that WireLurker, which is targeting users in China, "heralds a new era in malware attacking Apple's desktop and mobile platforms."

The WireLurker malware is the "biggest in scale" in the trojanized malware family, and it is able to attack iOS devices through OS X using USB. It's said to be able to infect iOS applications similar to a traditional virus, and it is the first malware capable of installing third-party applications on non-jailbroken iOS devices "through enterprise provisioning."

Thus far, WireLurker has been used in 467 OS X apps in the Maiyadi App Store, which is a third-party Mac app store in China. The apps have been downloaded 356,104 times, infecting hundreds of thousands of users.

According to the researchers, WireLurker looks for iOS devices connected via USB to an infected Mac, installing malicious third-party applications onto the device even without a jailbreak.

WireLurker monitors any iOS device connected via USB with an infected OS X computer and installs downloaded third-party applications or automatically generated malicious applications onto the device, regardless of whether it is jailbroken. This is the reason we call it "wire lurker". Researchers have demonstrated similar methods to attack non-jailbroken devices before; however, this malware combines a number of techniques to successfully realize a new brand of threat to all iOS devices.

WireLurker exhibits complex code structure, multiple component versions, file hiding, code obfuscation and customized encryption to thwart anti-reversing. In this whitepaper, we explain how WireLurker is delivered, the details of its malware progression, and specifics on its operation.

Once installed, WireLurker can collect information from iOS devices like contacts and iMessages, and it's able to request updates from attackers. It's said to be under "active development" with an unclear "ultimate goal."

Palo Alto Neworks offers several recommendations for avoiding apps infected with WireLurker, including an antivirus product and Mac App Store installation restrictions that prevent apps from unknown third parties from being installed. Users should not download and run Mac apps or games from third-parry app stores, download sites, or other untrusted sources and jailbreaking should be avoided.

Unknown enterprise provisioning profiles must be avoided as well, and users should avoid pairing their iOS devices with unknown computers or charging with chargers from untrusted or unknown sources.

Palo Alto Networks has notified Apple of the malware, but an Apple spokesperson declined to offer a comment.

Update: Apple has issued a statement to iMore about the issue:

"We are aware of malicious software available from a download site aimed at users in China," an Apple spokesperson told iMore, "and we've blocked the identified apps to prevent them from launching. As always, we recommend that users download and install software from trusted sources."

Top Rated Comments

mattcha90 Avatar
122 months ago
This is what everyone who always complain about Apple's vice-grip on openness doesn't understand. If you stick with the Apple pre-approved things you're safe 99.99% of the time. It's only when you open yourself to third party apps that you run the risk of malware. It can't exist without you opening the door to it.
Score: 59 Votes (Like | Disagree)
needfx Avatar
122 months ago
applebola




-
Score: 27 Votes (Like | Disagree)
fins831 Avatar
122 months ago
this is why I love the closed environment Apple creates, if the consumer is smart, they will be unaffected 99percent of the time. Walled garden protect me from all the bad stuff please haha
Score: 21 Votes (Like | Disagree)
bbeagle Avatar
122 months ago
Trojan software exists on ALL systems. This is nothing new.

Anyone can write a program on Windows/Unix/OS X to do ANYTHING. That's really the point of personal computers. There is nothing Apple/Microsoft or anyone can do to stop this outside of using their approved app stores where they can take down a malicious app like this.

This article is just iHater bait to people who don't understand how software works. A virus or worm is a different thing. A trojan - can happen to any operating system at any time. A trojan is basically software that says it does one thing then actually does something else. That's what Apple's App Store helps avoid, apps like this. This proves, again, that the Apple closed app store protects users better.
Score: 17 Votes (Like | Disagree)
fallenjt Avatar
122 months ago
Thanks, Apple for your closed system and malware free environment. People in China want to get cheap apps or free app and this is their result of being cheap.

----------

This is why I have always been a big fan of the walled garden!:cool::apple:
Not one of my Apple products has suffered any virus attacks.:cool::apple:

mine too. My Mac Mini is on 24/7 since bought in Nov 2011...no attack, virus, malware ever.
Score: 11 Votes (Like | Disagree)
Michael Goff Avatar
122 months ago
We gave jobs to them that just a few decades ago china had nothing to offer except fireworks! This is how they repay us in the many cruel ways that they have and the west refuses to wake up to what it's done to themselves! This could all be reversed.

And everyone who moved their business over there did it out of the kindness of their hearts, right?

:rolls eyes:
Score: 10 Votes (Like | Disagree)

Popular Stories

Beyond iPhone 13 Better Blue Face ID Single Camera Hole

Six Reasons to Wait for Next Year's iPhone 17

Thursday February 22, 2024 4:20 am PST by
Apple's iPhone development roadmap runs several years into the future and the company is continually working with suppliers on several successive iPhone models concurrently, which is why we sometimes get rumored feature leaks so far ahead of launch. The iPhone 17 series is no different, and already we have some idea of what to expect from Apple's 2025 smartphone lineup. If you plan to skip...
iPhone Notch

Apple Explored These Notch and Dynamic Island Designs for iPhones

Friday February 23, 2024 2:05 pm PST by
With the iPhone 14 Pro models in 2022, Apple introduced the Dynamic Island, which can morph and expand to display system alerts, sports scores, and a variety of other information. The feature makes the space surrounding the front camera and Face ID sensors useful compared to the notch on older iPhone models. Apple explored a variety of ideas for the iPhone's notch area over the years before...
General Apps Messages

Apple Announces 'Groundbreaking' New Security Protocol for iMessage

Wednesday February 21, 2024 6:00 am PST by
Apple today announced a new post-quantum cryptographic protocol for iMessage called PQ3. Apple says this "groundbreaking" and "state-of-the-art" protocol provides "extensive defenses against even highly sophisticated quantum attacks." Apple believes the PQ3 protocol's protections "surpass those in all other widely deployed messaging apps," according to its blog post:Today we are announcing...
Next Generation CarPlay Porsche 1

Apple Launching Next-Generation CarPlay This Year With These New Features

Wednesday February 21, 2024 2:03 pm PST by
Apple recently updated its website to confirm that the first vehicle models with next-generation CarPlay support will debut "in 2024." This wording is shown on Apple's regional websites for the U.S., Canada, Australia, New Zealand, and many other countries. The iOS 17.4 beta includes code-level references to eight new CarPlay apps:Auto Settings: This app will let you manage paired iPhones...
General Apps Messages

iOS 17.4 to Add This 'Groundbreaking' New Messaging Feature

Friday February 23, 2024 5:05 am PST by
With iOS 17.4, set to arrive in March 2024, Apple is bringing a new cryptographic security feature to iMessage called PQ3. This "groundbreaking" and "state-of-the-art" protocol provides "extensive defenses against even highly sophisticated quantum attacks," according to Apple. Let's break down what that means. Apple's iMessage service already supports end-to-end encryption, but security...
cracked glass vision pro

Handful of Apple Vision Pro Units Develop Identical Crack in Cover Glass

Friday February 23, 2024 4:46 am PST by
A small number of Apple Vision Pro owners have claimed that their headsets developed a hairline crack down the middle of the front cover glass, despite having never been dropped or mishandled. Photo of hairline crack in Vision Pro front glass (credit: Reddit user Inphenite) The first report was posted in the subreddit /r/VisionPro about 18 days ago, and several more have appeared in the last...
iOS 17

iOS 17.4 Will Add These New Features to Your iPhone

Monday February 19, 2024 6:52 am PST by
Apple last month confirmed that iOS 17.4 will be released in March, and the update includes several new features and changes for the iPhone. Key new features in iOS 17.4 include major App Store changes in the EU and Apple Podcasts transcripts. The update also adds new emoji and includes preparations for the launch of next-generation CarPlay later this year. More details about the new...
New Macs iPads iOS 17 4

What to Expect at Potential Apple Event in March: iPads, Macs, and More

Friday February 23, 2024 8:35 am PST by
Apple often holds its first media event of the year in March, so the company could be just weeks away from announcing new products. Below, we have outlined what to expect from a potential Apple Event this March. Past Apple Events in March Apple has held five events in March since 2015:Monday, March 9, 2015 Monday, March 21, 2016 Tuesday, March 27, 2018 Monday, March 25, 2019 Tuesday,...