What You Need to Know About iOS Malware XcodeGhost

xcode-6Earlier this week, Chinese developers disclosed new iOS malware called XcodeGhost on microblogging service Sina Weibo. U.S. cybersecurity firm Palo Alto Networks has since published details about the malware.

MacRumors has created a FAQ so you can learn more about XcodeGhost and how to keep your iOS devices protected.

What is XcodeGhost?
XcodeGhost is a new iOS malware arising from a malicious version of Xcode, Apple's official tool for developing iOS and OS X apps.

How is XcodeGhost distributed?
A malicious version of Xcode was uploaded to Chinese cloud file sharing service Baidu and downloaded by some iOS developers in China.

Chinese developers then unknowingly compiled iOS apps using the modified Xcode IDE and distributed those infected apps through the App Store.

Those apps then managed to pass through Apple's code review process, enabling iOS users to install or update the infected apps on their devices.

Which devices are affected?
iPhone, iPad and iPod touch models running an iOS version compatible with any of the infected apps. The malware affects both stock and jailbroken devices.

Which apps are affected?
Palo Alto Networks has shared a full list of over 50 infected iOS apps, including WeChat, NetEase Cloud Music, WinZip, Didi Chuxing, Railway 12306, China Unicom Mobile Office and Tonghuashun.

How many users are affected?
XcodeGhost potentially affects more than 500 million iOS users, primarily because messaging app WeChat is very popular in China and the Asia-Pacific region.

Which unofficial versions of Xcode are affected?
All unofficial versions between Xcode 6.1 and Xcode 6.4.

How does XcodeGhost put my iOS devices at risk?
iOS apps infected with XcodeGhost malware can and do collect information about devices and then encrypt and upload that data to command and control (C2) servers run by attackers through the HTTP protocol. The system and app information that can be collected includes:

  • Current time

  • Current infected app’s name

  • The app’s bundle identifier

  • Current device’s name and type

  • Current system’s language and country

  • Current device’s UUID

  • Network type

    Palo Alto Networks also discovered that infected iOS apps can receive commands from the attacker through the C2 server to perform the following actions:

  • Prompt a fake alert dialog to phish user credentials;

  • Hijack opening specific URLs based on their scheme, which could allow for exploitation of vulnerabilities in the iOS system or other iOS apps;

  • Read and write data in the user’s clipboard, which could be used to read the user’s password if that password is copied from a password management tool.

    Can XcodeGhost affect users outside of China?
    Yes. Some of the iOS apps infected with XcodeGhost malware are available on the App Store in countries outside of China. CamCard, for example, is a popular business card reader and scanner app available in the United States and several other countries, while WeChat is a popular messaging app in the Asia-Pacific region.

    Why would some Chinese developers download Xcode from Baidu?
    Xcode is a large file that can take a long time to download from Apple's servers in China, leading some developers to download Xcode from unofficial sources.

    How are Apple and Chinese developers dealing with XcodeGhost?
    Palo Alto Networks claims that it is cooperating with Apple on the issue, while multiple developers have updated their apps to remove the malware.

    Apple has since issued the following statement to Reuters:

    "We’ve removed the apps from the App Store that we know have been created with this counterfeit software. We are working with the developers to make sure they’re using the proper version of Xcode to rebuild their apps."

    How do I protect myself against XcodeGhost?
    iOS users should immediately uninstall any infected iOS app listed here on their devices, or update to a newer version that has removed the malware. Resetting your iCloud password, and any other passwords inputted on your iOS device, is also strongly recommended as a precautionary measure.

    Developers should install official versions of Xcode 7 or Xcode 7.1 beta from Apple's website for free and avoid downloading the software from unofficial sources.

  • Top Rated Comments

    jmantn Avatar
    76 months ago
    darn it, I thought only android gets malware.

    wechat is used in many countires :(
    Seriously what developer who knows anything about security is going to download an IDE from a non official source?

    That's like downloading an OS from The Pirate Bay and being shocked the file was injected with malicious code.
    Score: 63 Votes (Like | Disagree)
    deviant Avatar
    76 months ago
    i'm sorry but how can a developer be such an idiot (please don't ban me, there's no other word to describe patient's condition) to download Xcode from a chinese cloud file sharing service????
    Score: 56 Votes (Like | Disagree)
    Weaselboy Avatar
    76 months ago
    How do I protect myself against XcodeGhost?
    iOS users should immediately uninstall any infected iOS app listed here ('http://researchcenter.paloaltonetworks.com/2015/09/malware-xcodeghost-infects-39-ios-apps-including-wechat-affecting-hundreds-of-millions-of-users/') on their devices, or update to a newer version that has removed the malware. Resetting your iCloud password, and any other passwords inputted on your iOS device, is also strongly recommended as a precautionary measure.
    My thought is I am all done with any company that would use an Xcode version they got from a file sharing site rather than Apple directly. I would never trust them again.
    Score: 48 Votes (Like | Disagree)
    arn Avatar
    76 months ago
    Can't you just list all 39 apps? Looks like the servers from Palo Alto Networks can't handle it.
    Infected iOS apps
    网易云音乐 2.8.3
    微信 6.2.5
    讯飞输入法 5.1.1463
    滴滴出行 4.0.0.6-4.0.0.0
    滴滴打车 3.9.7.1 – 3.9.7
    铁路12306 4.5
    下厨房 4.3.2
    51卡保险箱 5.0.1
    中信银行动卡空间 3.3.12
    中国联通手机营业厅 3.2
    高德地图 7.3.8
    简书 2.9.1
    开眼 1.8.0
    Lifesmart 1.0.44
    网易公开课 4.2.8
    马拉马拉 1.1.0
    药给力 1.12.1
    喜马拉雅 4.3.8
    口袋记账 1.6.0
    同花顺 9.60.01
    快速问医生 7.73
    懒人周末
    微博相机
    豆瓣阅读
    CamScanner
    CamCard
    SegmentFault 2.8
    炒股公开课
    股市热点
    新三板
    滴滴司机
    OPlayer 2.1.05
    电话归属地助手 3.6.5
    愤怒的小鸟2 2.1.1
    夫妻床头话 1.2
    穷游 6.6.6
    我叫MT 5.0.1
    我叫MT 2 1.10.5
    自由之战 1.1.0

    Fox-IT (fox-it.com ('http://fox-it.com/')), a Netherlands based security company, checked all C2 domain names from our reports in their network sensors and has found thousands of malicious traffic outside China. According to their data, these iOS apps were also infected:

    Mercury
    WinZip
    Musical.ly
    PDFReader
    guaji_gangtai en
    Perfect365
    网易云音乐
    PDFReader Free
    WhiteTile
    IHexin
    WinZip Standard
    MoreLikers2
    CamScanner Lite
    MobileTicket
    iVMS-4500
    OPlayer Lite
    QYER
    golfsense
    同花顺
    ting
    installer
    下厨房
    golfsensehd
    Wallpapers10000
    CSMBP-AppStore
    礼包助手
    MSL108
    ChinaUnicom3.x
    TinyDeal.com
    snapgrab copy
    iOBD2
    PocketScanner
    CuteCUT
    AmHexinForPad
    SuperJewelsQuest2
    air2
    InstaFollower
    CamScanner Pro
    baba
    WeLoop
    DataMonitor
    爱推
    MSL070
    nice dev
    immtdchs
    OPlayer
    FlappyCircle
    高德地图
    BiaoQingBao
    SaveSnap
    WeChat
    Guitar Master
    jin
    WinZip Sector
    Quick Save
    CamCard
    Score: 28 Votes (Like | Disagree)
    SSD-GUY Avatar
    76 months ago
    So... It begins.

    iOS has been breached through the one thing that kept us safe. The App Store.
    Score: 27 Votes (Like | Disagree)
    mw360 Avatar
    76 months ago
    I don't think that's a correct analysis of the situation.
    What has really happened here? Developers have used the wrong tool (we'll discuss that later) and that tool has embedded some unwanted additional code in their apps. BUT look what still worked
    - each broken app STILL has to be submitted to the app store, with identification and an audit trail

    - even when the app is on an iOS device, there are severe limits to what it can do. It still can't break out of the OS protections, randomly control the device, etc. The type of info being sent back to base is, let's face it, not THAT serious --- not ideal, but not control of the machine.

    - The items that ARE problematic (and which Apple should work on fixing) are items that were problematic before we knew about this, and that have been used in other contexts --- the ability to phish for passwords by throwing up fake dialog boxes, and the way the current sandboxing FORCES Password apps like 1Password to transfer data over the Clipboard.

    What this REALLY provides is a way to throw out a bunch of these phishing scams in a way that can't be traced back to the real scammer; only to the developer using the wrong tool.

    Which gets us to that issue. I don't know enough about XCode to know what was and was not breached on that front. Obviously the entire XCode package should be signed, and obviously if you're stupid enough to install an XCode package that complains about being unsigned, you're setting yourself up for trouble. But blaming the victim, especially when the security landscape changes every year is not helpful --- how could Apple do better?
    You can't really avoid people being able to write their own compilers and dev tools, and you can't stop those dev tools from doing god knows what to the code they create --- this has been known since Pike's infamous C compiler of the early seventies.
    What you SHOULD be able to do is not allow code that has been created by such dev tools into the app store. THAT seems to be the flaw that needs to be fixed --- that any tool that's generating binaries that will land up in the store needs to be provably signed. But I don't know how feasible that is. Obviously the last stage (the actual store submitter app) is provided by Apple and signed, and using the developers signature. But what about the linker beforehand? And the compiler before that? And you then need the binaries passed between the two to be encrypted? It's just totally inimical to the current expected model of how we code.

    So what about at a higher level? Do something that's a ugly hack, but basically FORCE that any installer that calls itself "XCode" has to be signed no matter what? That's one package that you can't install regardless of your GateKeeper settings except from Apple. But then you get a wack-a-mole of packages called "XCode 7" and "XCode!" and "XCode Pro".
    Good analysis, but there is something Apple could have done, and I have been saying as much for over a year. Here's the more strongly worded one:

    They should ban their in-house teams from throwing up a password request box. Absolute ban. It has got out of hand recently with stock apps asking for the password without any justification or explanation and pretty much at random. I've said it over and over, Apple have been training their users for exactly this scenario - enter password whenever anyone asks. If an app needs the iCloud password it should instruct the user to enter it in the appropriate settings page. Train users: only the settings app should be trusted with passwords.
    Score: 26 Votes (Like | Disagree)

    Top Stories

    nothing ear 1 buds 1

    Nothing 'Ear (1)' True Wireless Earbuds Launch to Take on AirPods Pro With ANC and Unusual Design for $99

    Tuesday July 27, 2021 7:57 am PDT by
    Nothing, a new brand from OnePlus founder Carl Pei, has today officially launched the "Ear (1)" true wireless earbuds after months of anticipation around the company's AirPods Pro rival. The Ear (1) features an in-ear design, Active Noise Cancelation, Bluetooth 5.2, IPX4 water resistance, and a charging case with Qi-compatible wireless charging and a USB-C port. Fast pairing is supported on...
    iOS 14 on iPhone feature emergency

    Apple Releases iOS and iPadOS 14.7.1 With Fix for Touch ID Apple Watch Bug

    Monday July 26, 2021 9:48 am PDT by
    Apple today released iOS and iPadOS 14.7.1, minor bug fix updates that come just a week after the release of iOS 14.7, software that introduced new Apple Card features and support for the MagSafe Battery Pack. The iOS and iPadOS 14.7.1 updates can be downloaded for free and the software is available on all eligible devices over-the-air in the Settings app. To access the new software, go to...
    iPad mini pro feature 2

    iPad Mini 6 to Feature 8.3-Inch Display With No Home Button and Narrower Bezels

    Monday July 26, 2021 12:26 pm PDT by
    The sixth-generation iPad mini that's in the works will have an 8.3-inch display, according to display analyst Ross Young. That will be larger than the current 7.9-inch display, with the larger size due to the removal of the Home button and a narrower bezel design. Rumors about the iPad mini 6 have been picking up in recent weeks ahead of its prospective launch this fall. Apple analyst...
    iphone 12 pro gold

    Report: iPhone 14 Pro Models to Feature Tough Titanium Alloy Chassis

    Monday July 26, 2021 1:12 am PDT by
    Next year's "iPhone 14" series is expected to feature high-end models with a new titanium alloy chassis design, claims a new investors report by JP Morgan Chase. According to the report, the use of titanium alloy will be one of the biggest changes to the case design in the 2022 iPhone series, and Foxconn will be the exclusive manufacturer of the titanium frames for the high-end models....
    iOS 15 General Feature Purple

    Everything New in iOS 15 Beta 4: Safari Tweaks, MagSafe Battery Pack Support, Notification Updates and More

    Tuesday July 27, 2021 11:47 am PDT by
    Apple today released the fourth betas of iOS 15 and iPadOS 15, introducing additional refinements to the new features that are coming in the software updates. In these betas, Apple has introduced changes for Safari, Notifications, Focus mode, and more. Safari Updates Apple is continuing to refine the design of Safari on the iPhone, and in iOS 15, there are tweaks to improve usability. ...
    apple mac business page

    Apple Shares 11 Reasons Why Business Users Should Choose Macs

    Monday July 26, 2021 11:35 am PDT by
    Apple today updated its Apple at Work website with a new section dedicated to the Mac, which offers up 11 reasons why "Mac means business." On the webpage, Apple highlights the M1 chip as the number one reason why business users should choose a Mac, offering up an M1 overview [PDF] that explains the benefits of the M1 chip. The information isn't new, but it does provide a look at all of...
    imac with accessories

    Larger Redesigned High-End iMac Rumored to Launch Next Year

    Monday July 26, 2021 3:45 am PDT by
    Apple's larger redesigned iMac will arrive sometime in 2022 rather than later this year, according to the leaker known as "Dylandkt." On Twitter, Dylandkt claimed that Apple's "high end iMac" is not expected to release in the fourth quarter of 2021 alongside Apple's "M1X Macs" – a reference to Apple's redesigned MacBook Pro models – because "Apple simply does not want their devices to...
    General iOS 14

    iOS 14.7.1 and macOS Big Sur 11.5.1 Patch Security Vulnerability That May Have Been Actively Exploited

    Monday July 26, 2021 11:55 am PDT by
    Apple today released unexpected iOS 14.7.1 and iPadOS 14.7.1 updates to the public, and according to a newly released support document, the software addresses a serious security vulnerability that may have been exploited in the wild. Apple says that an application may have been able to execute arbitrary code with kernel privileges due to a memory corruption issue. "Apple is aware of a report ...
    apple bitcoin hack

    Is Apple Really Buying Bitcoin?

    Monday July 26, 2021 3:07 am PDT by
    A large number of websites and posts on social media are stoking rumors that Apple has purchased $2.5 billion worth of bitcoin in the company's first move into cryptocurrency, but is there any validity to the claims? Many people are citing the fact that Apple was looking for a Business Development Manager with experience in alternative payments, including cryptocurrency, earlier this year as ...
    new m1 chip

    Tim Cook on Apple Deciding to Manufacture Components: 'We Ask Ourselves If We Can Do Something Better'

    Tuesday July 27, 2021 3:04 pm PDT by
    During today's earnings call for the third fiscal quarter of 2021 (second calendar quarter), Apple CEO Tim Cook was asked how Apple decides what components to purchase and what components to develop, and Cook said that Apple asks if it can be done better. We ask ourselves if we can do something better. If we can deliver a better product. If we can buy something in the market and it's great...