XCodeGhost Found Hiding In U.S. And In Apple iOS 9 Apps

Meanwhile, exploit broker Zerodium says its paid a $1 million bounty for a remote iOS 9 zero-day.

XCodeGhost -- malware that snuck Trojanized iOS apps into the official App Store -- mostly threatened iOS users in China, but now
researchers at FireEye
have also found XCodeGhost-infected apps hitting targets in the United States. They also unearthed a stealthier variant, XCodeGhost S, that has weaponized iOS 9 apps and can bypass static detection.
XCodeGhost, first discovered in September, was the first malware to show that non-jailbroken iOS devices could be compromised. Attackers created a malicious version of Apples application development software, Xcode, and uploaded it to Chinese cloud storage service Baidu Yunpan -- a regional, third-party alternative to the Apple Store where download times are shorter for iOS and Mac developers in China. Then, innocent app developers used XcodeGhost to write apps and upload them to the official App Store, never knowing that those apps were malicious -- over 4,000 apps in all.
Apple removed the compromised apps from the App Store. The command-and-control servers were taken offline -- apparently
voluntarily by the malware authors
-- but they could be hijacked by other threat actors, and researchers since have found that XCodeGhost is still in action.
Since most of the affected app developers were in China, most of the 4,000 infected apps were those popular in China, yet some are also fairly popular in the U.S. and have compromised American users, says Raymond Wei, FireEyes senior director of mobile development.
In a four-week period, FireEye found 210 U.S. enterprises with infected apps, generating over 28,000 attempts to connect to command-and-control servers. The machines currently infected are mostly calling back to servers located in Germany (62%) and the U.S. (33%).
The main point, say Wei, is that what was originally a threat in China is no longer just in China.
In their investigation, FireEye also unearthed another variant, XCodeGhost S, which has been updated to Trojanize apps for iOS 9.
The variant was in operation at the same time as the original XCodeGhost, and Wei says the same malware authors were responsible for creating it, even if they arent responsible for its most recent activity.
Sep. 19, two days after the original XCodeGhost began attracting attention in China, someone claiming responsibility for it tweeted an apology, using the account @XcodeGhost-Author, saying it was just a coding experiment to explore the potential exploitation of a loophole in Xcode to enable advertisement delivery.
But Hong Jia, a researcher at ThreatBook Labs, a threat intelligence start-up based in China,
told DarkReading
last month that she wasnt convinced the apology was genuine -- partly because the code had stealth capabilities that went beyond what the authors claimed it did.
XCodeGhost Ss stealth functions include the ability to bypass static detection tools by using character concatenation. Wei says that is making it more difficult for FireEye to find the apps infected with XCodeGhost S than the original variant. So far theyve found two infected apps, but they expect to find more.
Now that this malware has been successful in cracking the Apple development environments walls of trust, will other attackers take the same approach?
I think its possible, but I think its unlikely to be the same kind of tactic, because of Apples swift action to block that sort of attack, Wei says. Regardless of the approach, however, app developers will always be a soft target, he says.
The alert raised by FireEye is very important, says ThreatBook Labs Jia. [Users] should upgrade their iOS to latest version and upgrade the infected Apps as soon as possible to avoid being hijacked, which is not a difficult thing to do by hacker.
Million-Dollar Bug Bounty
In other Apple news, intelligence contractor-slash-exploit broker Zerodium stated on Twitter that it paid out the $1 million bug bounty it promised for a remote iOS 9 exploit. The vulnerability is a browser-based jailbreak exploit.
Similar to Hacking Team, Zerodium sells zero-day vulnerabilities to government agencies to be used in offensive tools. Zerodium founder Chaouki Bekrar
told
The Register
We will first report the vulnerabilities to our customers, and we may later report them to Apple.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
XCodeGhost Found Hiding In U.S. And In Apple iOS 9 Apps