Posted on 11/12/2014 9:21:19 AM PST by SeekAndFind
Security provider FireEye (FEYE) is cautioning that an opening in Apples (AAPL) iOS leaves most iPhones and iPads vulnerable to hackers attempting to swap installed, trusted applications for rogue software capable of stealing sensitive and confidential information from the user.
FireEye first reported the bug to Apple in late July, dubbing the way it infiltrates iOS 7.1.1 and later devices (including the most recent iOS 8 and iOS 8.1 updates), a Masque Attack. The hack requires users first click on a malicious link included in an email or text message that targets the location of the malware download, tricking users into believing the intrusive software is legitimate and part of Apples App Store. The malware can replace trusted apps, such as banking or social networking, without the user realizing an intrusion has occurred.
This in-house app may display an arbitrary title (like 'New Flappy Bird') that lures the user to install it, but the app can replace another genuine app after installation, using the same bundle identifier, wrote FireEye researchers Hui Xue, Tao Wei and Yulong Zhang in a blog post.
Only apps baked into iOS, such as Mobile Safari, are immune from attack, the researchers said.
This vulnerability exists because iOS doesn't enforce matching certificates for apps with the same bundle identifier, FireEye wrote. We verified this vulnerability on iOS 7.1.1, 7.1.2, 8.0, 8.1 and 8.1.1 beta, for both jailbroken and non-jailbroken devices. An attacker can leverage this vulnerability both through wireless networks and USB.
Although the Masque Attack is similar to WireLurker, another iOS bug disclosed last week, in its ability to infiltrate a mobile device through USB, its far more dangerous, FireEyes researchers said.
After looking into WireLurker, we found that it started to utilize a limited form of Masque Attacks to attack iOS devices through USB, FireEye said. Masque Attacks can pose much bigger threats than WireLurker. Masque Attacks can replace authentic apps, such as banking and email apps, using attacker's malware through the Internet. That means the attacker can steal user's banking credentials by replacing an authentic banking app with malware that has identical UI.
FireEye said Apple mobile device users can protect themselves from Masque Attacks by not installing third-party apps, refraining from installing items in a third-party web pop-up and being mindful of iOS app warnings.
They suffer from MAPS:
Swordmaker's and Kathy's proposed diagnosis for the new ICD-10 addenda:
90210 iOS Munchausen's Apple-Plexy Syndrome (MAPS), The overwhelming compulsion to post negative, judgmental, aggressive, and false commentary on any website thread related to Apple products wherever found, including phobic reaction to projected Apple user euphoria. First and subsequent encounters.
It is even more explicit than that. We Mac users see it so rarely, we don't realize how dire the warning can be:
If you go ahead and install it after being told the file is going to "damage your computer" and that it "contains" a specific malware by name, AND gives you a button to move it to the Trash by merely clicking, YOU DESERVE any damage you do to your computer and your data, your privacy, your bank accounts, and your identity, from installing and running it!
If you do that, you are terminally stupid!
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.