Apple's Beats brand in April unveiled the Powerbeats Pro, a redesigned wire-free version of its popular fitness-oriented Powerbeats earbuds.
U.S. Government Warns iOS Users About 'Masque Attack' Vulnerability
The United States government today issued a bulletin warning iPhone and iPad users about the recent "Masque Attack" vulnerability, a security flaw that first surfaced on Monday of this week, reports Reuters. Masque Attack is a vulnerability that can allow malicious third-party iOS apps to masquerade as legitimate apps via iOS enterprise provision profiles.
Written by the National Cybersecurity and Communications Integration Center and the U.S. Computer Emergency Readiness Teams, the bulletin outlines how Masque Attack spreads -- luring users to install an untrusted app through a phishing link -- and what a malicious app is capable of doing.
Masque Attack in action
Computer security alerts issued by the government are fairly rare, and only 13 have been sent over the course of 2014. Other vulnerabilities that have prompted alerts include Heartbleed and an SSL 3.0 flaw called "Poodle."
FireEye, the team that discovered Masque Attack, has notified Apple about the vulnerability, but it has not been patched in the recent iOS 8.1.1 beta thus far. It also affects iOS 7.1.1, 7.1.2, 8.0, and 8.1, and as of today, Apple has not yet commented on Masque Attack.
Masque Attack, along with WireLurker, another vulnerability outlined earlier this month, is unlikely to affect the average iOS user so long as Apple's security features are not bypassed. Masque Attack works by circumventing the iOS App Store to install apps, while WireLurker is similar, infecting machines via third-party software downloaded outside of the Mac App Store.
Both WireLurker and Masque Attack can be avoided by staying away from suspicious apps and avoiding links that prompt users to install apps outside of Apple's App Stores.
Written by the National Cybersecurity and Communications Integration Center and the U.S. Computer Emergency Readiness Teams, the bulletin outlines how Masque Attack spreads -- luring users to install an untrusted app through a phishing link -- and what a malicious app is capable of doing.
An app installed on an iOS device using this technique may:The post also advises iOS users to protect themselves by avoiding apps that have been installed from sources other than the App Store or an organization they're affiliated with, avoiding tapping "Install" on third-party pop-ups when viewing web pages, and tapping "Don't Trust" on any iOS app that shows an "Untrusted App Developer Alert."
-Mimic the original app's login interface to steal the victim's login credentials.
-Access sensitive data from local data caches.
-Perform background monitoring of the user's device.
-Gain root privileges to the iOS device.
-Be indistinguishable from a genuine app.
Computer security alerts issued by the government are fairly rare, and only 13 have been sent over the course of 2014. Other vulnerabilities that have prompted alerts include Heartbleed and an SSL 3.0 flaw called "Poodle."
FireEye, the team that discovered Masque Attack, has notified Apple about the vulnerability, but it has not been patched in the recent iOS 8.1.1 beta thus far. It also affects iOS 7.1.1, 7.1.2, 8.0, and 8.1, and as of today, Apple has not yet commented on Masque Attack.
Masque Attack, along with WireLurker, another vulnerability outlined earlier this month, is unlikely to affect the average iOS user so long as Apple's security features are not bypassed. Masque Attack works by circumventing the iOS App Store to install apps, while WireLurker is similar, infecting machines via third-party software downloaded outside of the Mac App Store.
Both WireLurker and Masque Attack can be avoided by staying away from suspicious apps and avoiding links that prompt users to install apps outside of Apple's App Stores.
[ 125 comments ]
Top Rated Comments
(View all)
61 months ago
"iOS Enterprise Certificates".
Then it isn't a security flaw. I love how this Apple-centric site fails to mention that you actually have to install the certificate. This is blown way out of proportion!
If the US government is putting out an official warning, then it's not being blown out of proportion.
Stop apologizing for Apple. This is exactly how these situations come about in the first place: Too many people excusing Apple for problems with their software instead of pressing them to fix the problems.
61 months ago
"iOS Enterprise Certificates".
Then it isn't a security flaw. I love how this Apple-centric site fails to mention that you actually have to install the certificate. This is blown way out of proportion!
Sadly a large part of the iPhone user base will click ACCEPT to anything that pops up, without even reading it. It's what America has become... we don't read, then we complain we've been scammed.
61 months ago
"iOS Enterprise Certificates".
Then it isn't a security flaw. I love how this Apple-centric site fails to mention that you actually have to install the certificate. This is blown way out of proportion!
Then it isn't a security flaw. I love how this Apple-centric site fails to mention that you actually have to install the certificate. This is blown way out of proportion!
61 months ago
So - You only want apps that you get from the app store.
Don't apps have to be from the app store unless your phone is jailbroken?
Don't apps have to be from the app store unless your phone is jailbroken?
61 months ago
As much as trivial and "common sense"ish this may seem, there is absolutely nothing wrong with this type of warning. I don't understand the hate for it. If the US government released a warning about "please lock your doors at night.." will people be fundamentally against that also?
We have a lot warning labels on cars, on machines, on prescription drugs..this is no different.
Having the US government comment on the security of an Apple product negates the idea that Apple products are infallible. And apparently that upsets some people.
61 months ago
"unlikely to affect the average iOS user so long as Apple's security features are not bypassed"
Problem solved. Huge deal for nothing.
Problem solved. Huge deal for nothing.
61 months ago
So basically they're just telling people don't be stupid.
Slow your roll! This IS the US government...
61 months ago
So - You only want apps that you get from the app store.
Don't apps have to be from the app store unless your phone is jailbroken?
With an Enterprise Certificate you can download company specifc apps outside the AppStore.
[ Read All Comments ]
Elevation Lab, known for its line of popular iPhone charging docks, today released the FamilyCharger, a multi-charging setup designed to allow you to charge all of your devices in one place.
The...
Apple today seeded the third beta of an upcoming macOS Catalina update to its public beta testing group, two weeks after seeding the second public beta and a day after seeding the fourth developer...
Apple today seeded the third beta of an upcoming tvOS 13 update to its public beta testing group, two weeks after seeding the second public beta and day after seeding the fourth developer beta of...
Apple today began selling an updated version of the Rotor Riot wired game controller for iPhone and iPad through its online store. The new model features a redesigned directional pad, a built-in...
Los Angeles FC fans can now order food and drinks ahead of time directly on their iPhones at the Banc of California Stadium.
The MLS team has partnered with artificial intelligence platform...
An escalating trade war between Japan and South Korea could make Chinese manufacturer BOE Technology a "strong contender" for OLED display orders from Apple, according to industry sources who...
iPhone loyalty has hit its lowest level since 2011 and Samsung has been the main benefactor, claims a new survey conducted by trade-in service BankMyCell.
The survey, cited by CNET, tracked...
Sky: Children of the Light, by Journey developer thatgamecompany, is now available for iPhone, iPad, and iPod touch. Its release follows last year's launch of the beta version of the game, titled...
