U.S. Government Warns iOS Users About 'Masque Attack' Vulnerability

The United States government today issued a bulletin warning iPhone and iPad users about the recent "Masque Attack" vulnerability, a security flaw that first surfaced on Monday of this week, reports Reuters. Masque Attack is a vulnerability that can allow malicious third-party iOS apps to masquerade as legitimate apps via iOS enterprise provision profiles.

Written by the National Cybersecurity and Communications Integration Center and the U.S. Computer Emergency Readiness Teams, the bulletin outlines how Masque Attack spreads -- luring users to install an untrusted app through a phishing link -- and what a malicious app is capable of doing.

An app installed on an iOS device using this technique may:
-Mimic the original app's login interface to steal the victim's login credentials.
-Access sensitive data from local data caches.
-Perform background monitoring of the user's device.
-Gain root privileges to the iOS device.
-Be indistinguishable from a genuine app.

The post also advises iOS users to protect themselves by avoiding apps that have been installed from sources other than the App Store or an organization they're affiliated with, avoiding tapping "Install" on third-party pop-ups when viewing web pages, and tapping "Don't Trust" on any iOS app that shows an "Untrusted App Developer Alert."

Masque Attack in action

Computer security alerts issued by the government are fairly rare, and only 13 have been sent over the course of 2014. Other vulnerabilities that have prompted alerts include Heartbleed and an SSL 3.0 flaw called "Poodle."

FireEye, the team that discovered Masque Attack, has notified Apple about the vulnerability, but it has not been patched in the recent iOS 8.1.1 beta thus far. It also affects iOS 7.1.1, 7.1.2, 8.0, and 8.1, and as of today, Apple has not yet commented on Masque Attack.

Masque Attack, along with WireLurker, another vulnerability outlined earlier this month, is unlikely to affect the average iOS user so long as Apple's security features are not bypassed. Masque Attack works by circumventing the iOS App Store to install apps, while WireLurker is similar, infecting machines via third-party software downloaded outside of the Mac App Store.

Both WireLurker and Masque Attack can be avoided by staying away from suspicious apps and avoiding links that prompt users to install apps outside of Apple's App Stores.

Top Rated Comments

(View all)
Avatar
77 months ago

"iOS Enterprise Certificates".

Then it isn't a security flaw. I love how this Apple-centric site fails to mention that you actually have to install the certificate. This is blown way out of proportion!

If the US government is putting out an official warning, then it's not being blown out of proportion.

Stop apologizing for Apple. This is exactly how these situations come about in the first place: Too many people excusing Apple for problems with their software instead of pressing them to fix the problems.
Score: 22 Votes (Like | Disagree)
Avatar
77 months ago

"iOS Enterprise Certificates".

Then it isn't a security flaw. I love how this Apple-centric site fails to mention that you actually have to install the certificate. This is blown way out of proportion!


Sadly a large part of the iPhone user base will click ACCEPT to anything that pops up, without even reading it. It's what America has become... we don't read, then we complain we've been scammed.
Score: 18 Votes (Like | Disagree)
Avatar
77 months ago
So basically they're just telling people don't be stupid.
Score: 14 Votes (Like | Disagree)
Avatar
77 months ago
"iOS Enterprise Certificates".

Then it isn't a security flaw. I love how this Apple-centric site fails to mention that you actually have to install the certificate. This is blown way out of proportion!
Score: 13 Votes (Like | Disagree)
Avatar
77 months ago
So - You only want apps that you get from the app store.

Don't apps have to be from the app store unless your phone is jailbroken?
Score: 8 Votes (Like | Disagree)
Avatar
77 months ago

As much as trivial and "common sense"ish this may seem, there is absolutely nothing wrong with this type of warning. I don't understand the hate for it. If the US government released a warning about "please lock your doors at night.." will people be fundamentally against that also?

We have a lot warning labels on cars, on machines, on prescription drugs..this is no different.


Having the US government comment on the security of an Apple product negates the idea that Apple products are infallible. And apparently that upsets some people.
Score: 7 Votes (Like | Disagree)

Top Stories

'iPhone 12 mini' Name Reappears in Leaked Apple iPhone 12 Case Stickers

Friday September 25, 2020 1:58 am PDT by
Earlier this week a proven leaker claimed that the iPhone 12 lineup would be named "iPhone 12 mini," "iPhone 12," "iPhone 12 Pro," and "iPhone 12 Pro Max," and today the same nomenclature has appeared again in a photo depicting alleged stickers from unreleased Silicone iPhone cases originating from Apple's international distribution center in Ireland. The photo shows three stickers with the...

New Images Leak of iPhone 12 Braided USB-C to Lightning Cable

Thursday September 24, 2020 2:37 am PDT by
Rumors suggest Apple's upcoming iPhone 12 models will ship with a new Lightning to USB-C cable that includes a braided fabric design. Images of the purported cables were leaked in July, and today leaker Mr White has shared new images that give us a closer look at what we might get included in the iPhone 12 box. The photos show a USB-C to Lightning cable with a clearly braided design rather...

New Version of Microsoft Office Coming Next Year That Won't Require a Subscription

Thursday September 24, 2020 1:53 am PDT by
Microsoft will next year offer a new perpetual release of Microsoft Office for Mac and Windows that doesn't require a subscription to use, according to the software giant (via Windows Central). "Microsoft Office will also see a new perpetual release for both Windows and Mac, in the second half of 2021," said Microsoft in a blog post announcing the next version of its Exchange server,...

Apple Releases iOS 14.0.1 With Fix for Bug That Resets Default Apps After Rebooting

Thursday September 24, 2020 10:12 am PDT by
Apple today released iOS 14.0.1, the first update to the iOS 14 operating system that was released on September 16. Today's update is a bug fix update addressing issues that weren't able to be fixed in the initial iOS 14 launch. The iOS 14.0.1 update is available on all eligible devices over-the-air in the Settings app. To access the new software, go to Settings > General > Software Update. ...

Apple's iPhone 12 Event Could Happen on October 13 Based on Rumors From Mobile Operators

Wednesday September 23, 2020 11:51 am PDT by
Apple's upcoming iPhone-centric event could perhaps be held on Tuesday, October 13, according to information shared with MacRumors by an employee at a UK cellular carrier. There's no way for us to confirm the dates at this point in time nor are we sure on the credibility of the source, but even without a rumor, Tuesday, October 13 is a good guess based on Apple's historic launch timelines, ...

Apple Releases macOS Catalina 10.15.7 With Fixes for WiFi Bug, 27-Inch iMac Graphics Issues

Thursday September 24, 2020 10:32 am PDT by
Apple today released macOS Catalina 10.15.7, the latest update to the macOS Catalina software. macOS Catalina 10.15.7 fixes several major bugs that Mac users have been experiencing, and it comes a month after the latest macOS Catalina release. The ‌‌‌macOS Catalina‌‌‌ 10.15.6 Supplemental Update can be downloaded from the Mac App Store using the Update feature in the System...

Apple Designs Custom Face Mask for Corporate and Retail Employees [Updated with Unboxing]

Wednesday September 9, 2020 11:13 am PDT by
Apple's design team has created a new kind of protective mask that's being distributed to retail and corporate employees, reports Bloomberg. The mask is called the Apple Face Mask and it was developed in-house in Cupertino by the Engineering and Industrial Design teams at Apple. Last week, an Apple employee sent MacRumors an image of the mask design, which can be seen up above. The Apple ...

Video Offers Closer Look at Apple Face Mask

Friday September 25, 2020 5:25 am PDT by
YouTube channel Unbox Therapy has today shared a new video giving a closer look at Apple's reusable face masks for corporate and retail employees. Apple's own face mask was designed by the company's Engineering and Industrial Design teams amid the global health crisis for corporate and retail employees, and the boxes include Apple's famous "Designed by Apple in California" text. The...

Top Stories: iOS 14 Feature Tour, 'iPhone 12 mini' Rumors, Apple Watch Band Controversy

Saturday September 26, 2020 6:00 am PDT by
Things started to calm down a bit this week following last week's rush of media event, Apple Watch and iPad launches, and the release of iOS 14 and other operating updates. But that doesn't mean there wasn't still a lot of news, from digging deeper into iOS 14 to more iPhone 12 rumors to the uproar over trying to exchange band sizes on the new Apple Watch. On top of all of that, we heard...

Interest in iOS 14 Home Screen Ideas Helps Pinterest Break Daily Download Record

Wednesday September 23, 2020 4:37 am PDT by
Apple's introduction of widgets on the Home Screen in iOS 14 has driven a surge in interest among users looking to customize their iPhone, and that has reportedly had a knock-on effect for Pinterest, whose iOS app has seen record downloads as users flock to its content seeking design inspiration. As reported by TechCrunch, App Store intelligence firm Apptopia was first to note the impact of ...