Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

3/17/2016
05:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Apple iPhone Malware Exploits DRM Mechanism To Spread

But threat limited mainly to users looking to jailbreak phone or install pirated apps.

A new family of Apple iOS malware that has begun affecting users in China is another reminder of why it is generally not a good idea to jailbreak your iPhone or to download pirated software from unofficial mobile app stores.

The malware, dubbed AceDeceiver, has grabbed some attention for its ability to infect non-jailbroken iPhones just as easily as it can jailbroken ones.

Security vendor Palo Alto Networks, which reported on the threat this week, describes AceDeceiver as malware that exploits flaws in Apple’s Digital Rights Management (DRM) technology to install itself without any of the security mechanisms that are normally required.

AceDeceiver is the first malware to exploit a technique called “FairPlay Man-In-The-Middle (MITM)” that hackers have typically used to distribute pirated iOS software.

For the moment at least, AceDeceiver poses a threat only to users of a software tool called Aisi Helper. Many people in China have installed the tool on their Windows PCs to manage their iOS devices, says Ryan Olson, director of threat intelligence at Palo Alto Networks’ Unit 42.

Aisi Helper purports to help users carry out tasks like system re-installation, backup, and cleaning for iOS devices. It also serves as a tool for jailbreaking iOS devices and is often used by people who want to install free and likely pirated apps on their phones, Olson says.

According to Palo Alto Networks, as of Dec 2014, some 15 million people had downloaded the tool, and 6.6 million were using it actively.

Once installed on a PC, Aisi Helper surreptitiously downloads and installs AceDeceiver on the system, which in turn connects to a third-party iOS app store controlled by the authors of the software.

AceDeceiver prompts users for their AppleID and passwords, which it then sends to a remote server though it is not clear what exactly the authors of the software are doing or plan to do with it, Olson says.

The manner in which the malware authors have exploited Apple’s DRM mechanism to install AceDeciever on non-jailbroken iPhones is really the big issue, Palo Alto researcher Claud Xiao wrote in the company’s alert on the threat.

First, the authors of the malware managed to upload three versions of AceDeceiver to Apple’s official App Store by evading the company’s code review and filtering mechanisms, on seven separate occasions. Each time the app was disguised as a wallpaper app.

Apple has since removed the apps, but the authors of the malware can still distribute it by taking advantage of an Apple DRM mechanism called FairPlay.

FairPlay lets users purchase and download iOS apps from Apple’s App Store to their Macs or PCs, via iTunes. When a user then wants to upload the app to their iPhone or iPad, the device first checks with the iTunes software for an authorization code to ensure the app has been legally purchased.

Back in 2013, hackers discovered that by intercepting the communication between an iPhone or iPad and a Mac or PC that has downloaded an app from App Store, they could retrieve the authorization code and then use it to install the same app on other devices.

“The authorization codes differ from authorized computer to computer, but between the authorized computer and the phones there is not a check against a User ID,” Olson says. “So if a system has been authorized for an app, the MITM allows that app to be installed on many phones.”

In this case, all that the malware authors had to do was upload AceDeceiver to the App Store and then download it to a Mac or PC to get an authorization code for that computer, which they could then use repeatedly to install the malware on multiple iPhones and iPads.

What makes the technique dangerous is that it doesn’t require apps to have an enterprise certificate and therefore is not under the control of mobile device management tools, Xiao said. The method also doesn’t require users to take any manual action to install the malicious app.

In this case, the attack requires users to have downloaded and install Aisi Helper. The malware is also explicitly designed to work in China. Users from other regions who downloaded AceDeceiver while it was still available in App Store will only see the screensaver.

But there’s no reason why the same approach cannot be tweaked to deliver AceDeceiver and other malware in other regions as well.

“No technical reason exists,” says Guillaume Ross, senior security consultant, at Rapid7 in comments to Dark Reading. “It is possible that the Chinese market is slightly more susceptible to it due to the prevalence of third party application stores [and] more common use of jailbreaking tools,” he says.

 

Related Content:

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Breaches Are Inevitable, So Embrace the Chaos
Ariel Zeitlin, Chief Technology Officer & Co-Founder, Guardicore,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-2916
PUBLISHED: 2019-11-15
qtnx 0.9 stores non-custom SSH keys in a world-readable configuration file. If a user has a world-readable or world-executable home directory, another local system user could obtain the private key used to connect to remote NX sessions.
CVE-2019-12757
PUBLISHED: 2019-11-15
Symantec Endpoint Protection (SEP), prior to 14.2 RU2 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition (SEP SBE) prior to 12.1 RU6 MP10d (12.1.7510.7002), may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt t...
CVE-2019-12758
PUBLISHED: 2019-11-15
Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to an unsigned code execution vulnerability, which may allow an individual to execute code without a resident proper digital signature.
CVE-2019-12759
PUBLISHED: 2019-11-15
Symantec Endpoint Protection Manager (SEPM) and Symantec Mail Security for MS Exchange (SMSMSE), prior to versions 14.2 RU2 and 7.5.x respectively, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software applicat...
CVE-2019-18372
PUBLISHED: 2019-11-15
Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.