Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

3/17/2016
05:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Apple iPhone Malware Exploits DRM Mechanism To Spread

But threat limited mainly to users looking to jailbreak phone or install pirated apps.

A new family of Apple iOS malware that has begun affecting users in China is another reminder of why it is generally not a good idea to jailbreak your iPhone or to download pirated software from unofficial mobile app stores.

The malware, dubbed AceDeceiver, has grabbed some attention for its ability to infect non-jailbroken iPhones just as easily as it can jailbroken ones.

Security vendor Palo Alto Networks, which reported on the threat this week, describes AceDeceiver as malware that exploits flaws in Apple’s Digital Rights Management (DRM) technology to install itself without any of the security mechanisms that are normally required.

AceDeceiver is the first malware to exploit a technique called “FairPlay Man-In-The-Middle (MITM)” that hackers have typically used to distribute pirated iOS software.

For the moment at least, AceDeceiver poses a threat only to users of a software tool called Aisi Helper. Many people in China have installed the tool on their Windows PCs to manage their iOS devices, says Ryan Olson, director of threat intelligence at Palo Alto Networks’ Unit 42.

Aisi Helper purports to help users carry out tasks like system re-installation, backup, and cleaning for iOS devices. It also serves as a tool for jailbreaking iOS devices and is often used by people who want to install free and likely pirated apps on their phones, Olson says.

According to Palo Alto Networks, as of Dec 2014, some 15 million people had downloaded the tool, and 6.6 million were using it actively.

Once installed on a PC, Aisi Helper surreptitiously downloads and installs AceDeceiver on the system, which in turn connects to a third-party iOS app store controlled by the authors of the software.

AceDeceiver prompts users for their AppleID and passwords, which it then sends to a remote server though it is not clear what exactly the authors of the software are doing or plan to do with it, Olson says.

The manner in which the malware authors have exploited Apple’s DRM mechanism to install AceDeciever on non-jailbroken iPhones is really the big issue, Palo Alto researcher Claud Xiao wrote in the company’s alert on the threat.

First, the authors of the malware managed to upload three versions of AceDeceiver to Apple’s official App Store by evading the company’s code review and filtering mechanisms, on seven separate occasions. Each time the app was disguised as a wallpaper app.

Apple has since removed the apps, but the authors of the malware can still distribute it by taking advantage of an Apple DRM mechanism called FairPlay.

FairPlay lets users purchase and download iOS apps from Apple’s App Store to their Macs or PCs, via iTunes. When a user then wants to upload the app to their iPhone or iPad, the device first checks with the iTunes software for an authorization code to ensure the app has been legally purchased.

Back in 2013, hackers discovered that by intercepting the communication between an iPhone or iPad and a Mac or PC that has downloaded an app from App Store, they could retrieve the authorization code and then use it to install the same app on other devices.

“The authorization codes differ from authorized computer to computer, but between the authorized computer and the phones there is not a check against a User ID,” Olson says. “So if a system has been authorized for an app, the MITM allows that app to be installed on many phones.”

In this case, all that the malware authors had to do was upload AceDeceiver to the App Store and then download it to a Mac or PC to get an authorization code for that computer, which they could then use repeatedly to install the malware on multiple iPhones and iPads.

What makes the technique dangerous is that it doesn’t require apps to have an enterprise certificate and therefore is not under the control of mobile device management tools, Xiao said. The method also doesn’t require users to take any manual action to install the malicious app.

In this case, the attack requires users to have downloaded and install Aisi Helper. The malware is also explicitly designed to work in China. Users from other regions who downloaded AceDeceiver while it was still available in App Store will only see the screensaver.

But there’s no reason why the same approach cannot be tweaked to deliver AceDeceiver and other malware in other regions as well.

“No technical reason exists,” says Guillaume Ross, senior security consultant, at Rapid7 in comments to Dark Reading. “It is possible that the Chinese market is slightly more susceptible to it due to the prevalence of third party application stores [and] more common use of jailbreaking tools,” he says.

 

Related Content:

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "SpearPhish! Everyone out of the office!"
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13584
PUBLISHED: 2019-07-17
The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 allows Directory Traversal via a forged HTTP request.
CVE-2019-13585
PUBLISHED: 2019-07-17
The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 has a Buffer Overflow via a forged HTTP request.
CVE-2019-13631
PUBLISHED: 2019-07-17
In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages.
CVE-2019-13614
PUBLISHED: 2019-07-17
CMD_SET_CONFIG_COUNTRY in the TP-Link Device Debug protocol in TP-Link Archer C1200 1.0.0 Build 20180502 rel.45702 and earlier is prone to a stack-based buffer overflow, which allows a remote attacker to achieve code execution or denial of service by sending a crafted payload to the listening server...
CVE-2019-10100
PUBLISHED: 2019-07-17
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab.