Menu
Apple blocks infected WireLurker apps from running

Apple blocks infected WireLurker apps from running

The company advised that people stick to trusted sources for downloading apps

Apple has acted quickly to address a malware threat to iOS and Mac OSX computers, saying Thursday it has blocked apps from running that are infected with the WireLurker malicious code.

A day earlier, security vendor Palo Alto Networks revealed a campaign in which hackers were transferring malware to Apple devices through infected desktop applications downloaded from a Chinese marketplace.

The attack was a novel one in that it compromised iOS devices that had not been jailbroken, or altered to remove the restrictions that prevent people from downloading apps outside of the thoroughly-vetted App store.

About 467 Mac desktop applications were found to be infected with WireLurker at an app store for Chinese users called Maiyadi. The malware waits until an iOS device is connected to the desktop via USB, then uses one of a two methods to infect the mobile device. WireLurker can then steal data from the device, such as phone logs.

Apple didn't say exactly what steps it has taken to stop the attack, but said "we are aware of malicious software available from a download site aimed at users in China, and weve blocked the identified apps to prevent them from launching."

The company reiterated its longstanding advice to download software only from trusted sources.

Dave Jevans, founder and CTO for mobile security company Marble Security, said Apple had a few different options for thwarting WireLurker.

One way it infects devices is by using an enterprise provisioning certificate, which is used by developers building apps for in-house that don't appear on the App Store. The certificates are what allows those apps to run on iOS, and in the hands of a malicious hacker could be used to spread infected applications. Apple revoked the certificate used by WireLurker's creators, Jevans said.

That would help protect phones that aren't jailbroken from running infected apps, but it might not help those whose devices have already been infected, he said.

Apple could also update Safari to prevent people from navigating to the Maiyadi website, but users would still be able to get there using Chrome or other browsers. The company could also update its XProtect antivirus engine with a signature to block WireLurker installations, Jevans said.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags ApplesecuritymalwareMarble Security

Featured

Slideshows

Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
HP re-imagines education through Auckland event launch

HP re-imagines education through Auckland event launch

HP New Zealand held an inaugural Evolve Education event at Aotea Centre in Auckland, welcoming over 70 principals, teachers and education experts to explore ways of shaping and enhancing learning using technology.

HP re-imagines education through Auckland event launch
Show Comments