Windows malware hides in iOS app

Infected app still available on Apple's App Store

Windows malware slipped past Apple's eye and has been found tucked into software available on the company's iOS App Store.

Although the malware, labeled a worm by Microsoft and tagged as "Win32/VB.CB" by the company, is ineffective against Apple's iOS and OS X operating systems, it may pose a threat to iTunes customers who download iPhone and iPad apps to their Windows PCs before syncing to their mobile devices.

CNET first reported on the worm earlier Tuesday.

A user reported Win32/VB.CB to Apple's support forum around 10:30 a.m. ET Tuesday. The user, identified only as "deesto," said that his or her OS X antivirus warned that "Instaquotes-Quotes Cards for Instagram" was infected.

"I just downloaded two apps from iTunes, and one of them has been flagged by ClamXav as being a virus," wrote deesto.

While others commenting on the same support thread initially suspected the warning may have been a false positive by the antivirus software, CNET and Computerworld separately confirmed that the app was, in fact, harboring the worm.

Computerworld extracted the app's .ipa archive -- the packaging format Apple uses to deliver its apps -- on a Windows 7 PC, then scanned the system using Microsoft's free Security Essentials antivirus program.

Security Essentials flagged the file and warned that it contained Win32/VB.CB.

According to Microsoft's website, the worm harks back to 2008 and is known by several other names, including W32.Imaut.AS (Symantec), W32/Autorun.worm.h (McAfee) and W32/VB-DGA (Sophos).

Microsoft said that the worm "attempts to spread via Yahoo! Messenger ... [and] may also connect to a remote server to download arbitrary files."

Another commenter on the support thread downplayed the threat, even to Windows users, and posed a possible explanation for the infected app.

"It is nothing to worry about," said the commenter, tagged as "etresoft," several hours after deesto opened the discussion. "Considering where this virus is located, it wouldn't even hurt a Windows machine. It looks like an accident from the developer's infected Windows machine."

As of 3 p.m. ET, Instaquotes-Quotes Cards for Instagram was still available on Apple's iOS App Store. According to iTunes, the app launched July 19. On Tuesday, the developer's Facebook page included a comment from a user warning that the app was infected.

The developer, identified as Ilyas Hassani of Morocco, could not be reached for comment, and the website he referenced on his Facebook page appeared to be offline.

Hassani joined Facebook on June 1.

Microsoft's Security Essentials antivirus flagged the installation package for an iOS app as infected with a four-year-old worm.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His email address is gkeizer@computerworld.com.

See more by Gregg Keizer on Computerworld.com.

Read more about application security in Computerworld's Application Security Topic Center.

Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Webroot Web Security

Proactive web security that blocks threats in the cloud before they reach users’ machines, or enter customers’ networks.

more »

Submit your own security event

Submit your training courses

Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.

Read More
more »