Apple yanks malware from AppStore that targets non-jailbroken iPhones

China proves again to be the frontline of new malware attacks on the iPhone with Apple recently pulling three malicious apps from its App Store.

The malicious apps, discovered by security firm Palo Alto Networks, exploit “design flaws” in an Apple digital rights management (DRM) feature known as Apple FairPlay that is used to securely hand-off apps downloaded through iTunes on the desktop to an iPhone.

Apple has now removed the three malicious apps that security firm has called collectively “AceDeceiver”. All three posed as wallpaper apps.

Unlike previous iOS malware, the malicious apps don’t rely on enterprise certificates to infect iPhones, such as the YiSpecter malware that also targeted non-jailbroken Chinese iPhones.

Instead, the attackers use a so-called man-in-the-middle attack on FairPlay carried out by a rogue iOS utility for Windows machines, called Aisi Helper. An iPhone can be infected once physically connected to a computer with the attack program installed.

“Aisi Helper purports to be software that provides services for iOS devices such as system re-installation, jailbreaking, system backup, device management and system cleaning. But what it’s also doing is surreptitiously installing the malicious apps on any iOS device that is connected to the PC on which Aisi Helper is installed,” Claud Xiao, a researcher at Palo Alto Networks explains.

The DRM aspect of the attack arises from the attackers being able to intercept an authorisation code after purchasing an app from the App Store. This is used to simulate iTunes client behaviours on a PC and, according to Xiao, “tricks iOS devices to believe the app was purchased by the victim”.

The attack also appears to be an effort to phish App Store and iTunes credentials from potential victims by the now-removed malicious apps leading them to a non-Apple app store.

Xiao suggests Apple’s review process may be a little too US-centric since the three malicious apps escaped detection in at least seven reviews and only displayed bad behaviour when reaching iPhones from China.

Read more: Top news sites abused in massive malicious ad push

“In this case, AceDeceiver only displays malicious behaviors when a user is located in China, but that would be easy for the attacker to change in any time,” he noted.

Last chance to register for the CSO Perspectives Roadshow on March 22nd.

  • Hear from International keynote speakers:Robert Lentz, and Graham Cluley,
  • A Security Awareness stream
  • 18 different interactive Security Exchange discussions

Join CSO for a day of networking with your peers, engaging and discussing topics relevant to you, hearing from some of the top worldwide IT Security leaders in the market and attending the exhibition floor to win some amazing prizes.

Participate in this short survey on IT security strategies across the Australian market and go in the draw to WIN a 360Fly camera vailued at $689.

Start survey NOW

Read more: ​RSA Conference 2016 – The Top Five Issues

Join the CSO newsletter!

Error: Please check your email address.

Tags iPhonespalo alto networksAceDeceiverAppleappstoremalwareiTunesCSO Australia

More about AppleCSOIT SecurityPalo Alto Networks

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Liam Tung

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place