Hacking Campaign Targets iPhone Users With Data-Stealing, Location-Tracking Malware (zdnet.com) 37
ZDNet reports of a new mobile malware campaign that is "gaining access to iPhones by tricking users to download an open-source mobile device management (MDM) software package." From the report: Once in control, the unidentified hackers can steal various forms of sensitive information from infected devices, including the phone number, serial number, location, contact details, user's photos, SMS, and Telegram and WhatsApp chat messages. Thirteen users -- all in India -- have been been compromised in the attacks, which have been detailed by Cisco Talos. Those infected use a range of iPhone models and are running iOS versions ranging from 10.2.1 to 11.2.6. The campaign has been active since August 2015. The attackers take control by using the MDM package, which can give attackers complete control of the device and the ability to install fake versions of real apps.
Two different MDM services are used in the campaign, enabling system-level control of multiple devices from one location and the ability to install, remove and exfiltrate data from apps. One method of stealing data comes via malicious versions of messaging services like Telegram and WhatsApp being pushed onto the compromised device via fake updates. The apps look legitimate to the user, but malicious code sends information -- including messages, photos and contacts -- to a central command and control server. Deploying these apps requires a side-loading injection technique, which allows for the ability to ask for additional permissions, execute code and steal information from the original application.
Two different MDM services are used in the campaign, enabling system-level control of multiple devices from one location and the ability to install, remove and exfiltrate data from apps. One method of stealing data comes via malicious versions of messaging services like Telegram and WhatsApp being pushed onto the compromised device via fake updates. The apps look legitimate to the user, but malicious code sends information -- including messages, photos and contacts -- to a central command and control server. Deploying these apps requires a side-loading injection technique, which allows for the ability to ask for additional permissions, execute code and steal information from the original application.
Re: (Score:1)
Stormy Daniels isn't newsworthy, it's a story that's already known about Trump.
Re: (Score:1)
But wait, I thought the App Store made Apple immune to malware, which is why it's supposed to be so much better than Android, at the cost of not being able to run the apps you want without paying Apple for the privilege.
Oops!
It doesn't come from the App Store, genius. You have to sideload it and do other stupid shit to get this thing installed.
Re: (Score:2)
In the days of iPhone 4, they left holes allowing a site called jailbreak.me to allow alternate app stores like Cydia to exist on the phone... most of which were tests of features that are now part of the standard iOS.
This is where the MDM software "sideloads" in... it's gaining increased permissions that belong to MDM limiters, and instead it's malware.
Re: (Score:3)
It's an Apple App Store error... they approved a piece of malware that used MDM software elevation to get through limits on typical apps.
Old Tricks (Score:2, Insightful)
You know, these used to just be called "Trojans". But that long-winded description works, too.
Re: (Score:3)
This is a Trogran pretended to be MDM/antivirus... sort of like Norton.
Re:Apple screwed up, film at eleven. (Score:4, Informative)
What we have here is a malware program that got certified by Apple... but this appears to only be in India's version of the app store. Cleanup should be quick, and it's less than 20 reported cases of trouble so far.
Re: (Score:1)
No. What we have here is a person that didn't bother to read the article and is speaking out of their ass.
You can install an enterprise certificate that allows installation of software outside the Apple Store. This is how businesses use internal software on iOS devices. In this case, social engineering was used to allow the certificates and have the users install the MDM. After that, these devices could be remotely controlled .
Re:Apple screwed up, film at eleven. (Score:5, Interesting)
What we have here is a malware program that got certified by Apple...
Based on the vague description in the article... I don’t believe that’s the case.
The article refers to a multistep process and tricking users into adding certificates as trusted. This sounds more like an end-around the App Store - if your phone trusts a certificate, you can load developer apps directly onto a phone via Xcode, Cydia Impactor, or other similar tools. You’re basically side-loading an app without having to get past the App Store’s restrictions.
Re: (Score:3)
Re: (Score:2)
What we have here is a malware program that got certified by Apple... but this appears to only be in India's version of the app store. Cleanup should be quick, and it's less than 20 reported cases of trouble so far.
Less than 20 cases... IN THREE YEARS!
As Trojans go, this one is wildly UNsuccessful...
Re: (Score:3)
Re: (Score:2)
13 people getting their iPhone pwned is 13 people too many. The yell to Slashdot is putting everybody on alert that an iOS we thought was secure has its first bad hack.
Re:13 people!?! Why is this news? (Score:5, Insightful)
Anti-Virus Hooks... do we still need them? (Score:2, Interesting)
Seems like MDM is a codeword for what we call 'antivirus" on a PC/Mac. The antivirus developers have been given hooks that go all the way to BIOS, while a typical program can't touch system files nor the BIOS. We expect the certified antivirus programs to play by rules, but there's nothing preventing things like Norton's occasional behavior of starting P2P hole checks that end up overflowing the internet pipes.
So, here we are with a bunch of India cases of users trusting malware as their iPhone MDM/antiviru
Re: (Score:2, Insightful)
Re: (Score:1)
MDM is an acronym for Mobile Device Management. Of course, you would know that if you read the article, or had a business issued or connected device.
Soooo (Score:2)
Did anyone else read headline as election related? (Score:2)
Did anyone else initially read the headline as being about a political campaign using iPhone malware to research their target voters?