U.S. Government Warns iOS Users About 'Masque Attack' Vulnerability

The United States government today issued a bulletin warning iPhone and iPad users about the recent "Masque Attack" vulnerability, a security flaw that first surfaced on Monday of this week, reports Reuters. Masque Attack is a vulnerability that can allow malicious third-party iOS apps to masquerade as legitimate apps via iOS enterprise provision profiles.

Written by the National Cybersecurity and Communications Integration Center and the U.S. Computer Emergency Readiness Teams, the bulletin outlines how Masque Attack spreads -- luring users to install an untrusted app through a phishing link -- and what a malicious app is capable of doing.

An app installed on an iOS device using this technique may:
-Mimic the original app's login interface to steal the victim's login credentials.
-Access sensitive data from local data caches.
-Perform background monitoring of the user's device.
-Gain root privileges to the iOS device.
-Be indistinguishable from a genuine app.

The post also advises iOS users to protect themselves by avoiding apps that have been installed from sources other than the App Store or an organization they're affiliated with, avoiding tapping "Install" on third-party pop-ups when viewing web pages, and tapping "Don't Trust" on any iOS app that shows an "Untrusted App Developer Alert."

Masque Attack in action

Computer security alerts issued by the government are fairly rare, and only 13 have been sent over the course of 2014. Other vulnerabilities that have prompted alerts include Heartbleed and an SSL 3.0 flaw called "Poodle."

FireEye, the team that discovered Masque Attack, has notified Apple about the vulnerability, but it has not been patched in the recent iOS 8.1.1 beta thus far. It also affects iOS 7.1.1, 7.1.2, 8.0, and 8.1, and as of today, Apple has not yet commented on Masque Attack.

Masque Attack, along with WireLurker, another vulnerability outlined earlier this month, is unlikely to affect the average iOS user so long as Apple's security features are not bypassed. Masque Attack works by circumventing the iOS App Store to install apps, while WireLurker is similar, infecting machines via third-party software downloaded outside of the Mac App Store.

Both WireLurker and Masque Attack can be avoided by staying away from suspicious apps and avoiding links that prompt users to install apps outside of Apple's App Stores.

Top Rated Comments

spectrumfox Avatar
81 months ago

"iOS Enterprise Certificates".

Then it isn't a security flaw. I love how this Apple-centric site fails to mention that you actually have to install the certificate. This is blown way out of proportion!

If the US government is putting out an official warning, then it's not being blown out of proportion.

Stop apologizing for Apple. This is exactly how these situations come about in the first place: Too many people excusing Apple for problems with their software instead of pressing them to fix the problems.
Score: 22 Votes (Like | Disagree)
shenan1982 Avatar
81 months ago

"iOS Enterprise Certificates".

Then it isn't a security flaw. I love how this Apple-centric site fails to mention that you actually have to install the certificate. This is blown way out of proportion!


Sadly a large part of the iPhone user base will click ACCEPT to anything that pops up, without even reading it. It's what America has become... we don't read, then we complain we've been scammed.
Score: 18 Votes (Like | Disagree)
Rogifan Avatar
81 months ago
So basically they're just telling people don't be stupid.
Score: 14 Votes (Like | Disagree)
SolarShane Avatar
81 months ago
"iOS Enterprise Certificates".

Then it isn't a security flaw. I love how this Apple-centric site fails to mention that you actually have to install the certificate. This is blown way out of proportion!
Score: 13 Votes (Like | Disagree)
KdParker Avatar
81 months ago
So - You only want apps that you get from the app store.

Don't apps have to be from the app store unless your phone is jailbroken?
Score: 8 Votes (Like | Disagree)
spectrumfox Avatar
81 months ago

As much as trivial and "common sense"ish this may seem, there is absolutely nothing wrong with this type of warning. I don't understand the hate for it. If the US government released a warning about "please lock your doors at night.." will people be fundamentally against that also?

We have a lot warning labels on cars, on machines, on prescription drugs..this is no different.


Having the US government comment on the security of an Apple product negates the idea that Apple products are infallible. And apparently that upsets some people.
Score: 7 Votes (Like | Disagree)

Top Stories

lg wing

LG Considering Exit From Smartphone Business, Halts LCD Production for iPhone

Wednesday January 20, 2021 5:38 am PST by
LG is considering exiting the smartphone business entirely amid declining shipments and accrued losses of $4.5 billion over the past five years (via The Korea Herald). LG CEO Kwon Bong-Seok cautioned staff earlier today that the company is re-evaluating its presence in the smartphone industry: Since the competition in the global market for mobile devices is getting fiercer, it is about...
2019 mac pro side and front

Tim Cook Gifted Donald Trump 'First' 2019 Mac Pro

Wednesday January 20, 2021 5:45 pm PST by
Apple CEO Tim Cook gifted former United States President Donald Trump with the first 2019 Mac Pro that came off of the assembly line in Austin, Texas, according to a financial disclosure report that was released today (via The Verge). "Mac Pro Computer, the first created at the Flex Factory in Austin, Texas," reads the entry, which values the machine at $5,999, the base price for a Mac Pro....
Apple VR Feature

Bloomberg: Apple's First AR/VR Headset 'Pricey, Niche Precursor' to More Ambitious AR Glasses and Could Launch Next Year

Thursday January 21, 2021 3:27 am PST by
Apple's first virtual reality headset will be a "pricey, niche precursor" to a more ambitious augmented reality product, according to a new report from Bloomberg's Mark Gurman. As a mostly virtual reality device, it will display an all-encompassing 3-D digital environment for gaming, watching video and communicating. AR functionality, the ability to overlay images and information over a view...
Flat MacBook Air Feature

Bloomberg: Apple Working on 'Thinner and Lighter' High-End MacBook Air With MagSafe, Could Launch in Second Half of 2021

Friday January 22, 2021 3:34 am PST by
Apple is working on a "thinner and lighter" version of the MacBook Air that the company plans to release during the second half of this year at the earliest or in 2022, according to a new report by well-connected Bloomberg journalist Mark Gurman. It will include Apple's MagSafe charging technology and a next-generation version of the company's in-house Mac processors. Apple has discussed...
iOS 15 icon mock banner

iOS 15 Rumored to Drop Support for iPhone 6s and 2016 iPhone SE

Thursday January 21, 2021 11:58 am PST by
Apple's upcoming iOS 15 operating system, which we expect to see unveiled in June, is rumored to be dropping support for a few of Apple's older iPhones. According to French site iPhoneSoft, iOS 15 will not be able to be installed on the iPhone 6s, the iPhone 6s Plus, or the 2016 iPhone SE, all of which have an A9 chip. The iPhone 6s and 6s Plus were introduced in 2015 and are now more...
iphone 12 vs iphone 12 mini

Apple Shifting Some Production From iPhone 12 mini to iPhone 12 Pro to Meet Demand

Wednesday January 20, 2021 8:12 am PST by
Apple has reportedly cut production of the iPhone 12 mini by two million units to create more manufacturing capacity for the iPhone 12 Pro, according to a new Morgan Stanley investment note seen by PED30. Apple is believed to have made the switch for the first quarter of 2021 in an effort to combat continuing lead times for the more popular iPhone 12 Pro. iPhone 12 Pro lead times remain ...
iPhone 13 Notch Feature

iPhone 13 Rumored to Feature Smaller Notch, Pro Model Cameras to Use Larger Image Sensor

Thursday January 21, 2021 1:38 am PST by
Apple's iPhone 13 series will feature a redesigned Face ID system that will allow for a smaller notch at the top of the screen, according to a new report today. The rumor comes via hit-and-miss Taiwanese industry publication DigiTimes, whose supply chain sources also claim that the ultra wide-angle lens in Apple's next-generation iPhones is due for an upgrade. The next-generation iPhones'...
maxresdefault

Video Demos macOS Catalina Running on iPad Pro via x86 Emulation

Thursday January 21, 2021 11:36 am PST by
A video demonstrating macOS Catalina running on a current 2020 iPad Pro has been shared on YouTube, giving us a look at an interesting hack that has a Mac OS up and working on one of Apple's iPads. There's limited information about how the process of getting macOS Catalina on an iPad Pro works, but it uses x86 emulation and was done through the UTM software that allows virtual machines to...
iOS 14

Apple Seeds iOS 14.4 and iPadOS 14.4 Release Candidate to Developers and Public Beta Testers

Thursday January 21, 2021 10:14 am PST by
Apple today seeded the RC version of upcoming iOS 14.4 and iPadOS 14.4 updates to developers for testing purposes, with the new betas coming a week after Apple released the second betas. iOS 14.4 and iPadOS 14.4 can be downloaded through the Apple Developer Center or over the air after the proper profile has been installed on an iPhone or iPad. Paired with the HomePod 14.4 beta that is...
iPhone OIS Feature2

Sensor-Shift Camera Stabilization Rumored to Expand to Entire iPhone 13 Lineup

Wednesday January 20, 2021 7:46 am PST by
The entire iPhone 13 lineup will feature sensor-shift optical image stabilization, compared to only the iPhone 12 Pro Max among current models, according to a brief story preview shared today by Taiwanese publication DigiTimes. "Apple's next-generation iPhones slated for launch in the second half of 2021 will all come with sensor-shift stabilization technology, according to industry...