Menu
Attackers exploit Apple DRM weakness to infect non-jailbroken iOS devices

Attackers exploit Apple DRM weakness to infect non-jailbroken iOS devices

If a malicious app is published on the App Store once and then is removed, attackers can continue to infect devices with it through PC malware

Attackers are exploiting a weakness in Apple's digital rights management technology to install malicious apps on supposedly protected, non-jailbroken iOS devices.

In late February, security researchers from Palo Alto Networks found three malicious applications on the official App Store. An analysis revealed the malicious apps were part of a scheme to steal Apple IDs and passwords from Chinese users under the guise of an alternative app store.

The more interesting aspect of the apps: In addition to being published on the official app store, they were also silently installed through software running on users' Windows PCs.

An iOS device that hasn't been jailbroken, and hasn't had its security restrictions removed, should only be able to run apps downloaded from the App Store or installed through the iTunes software from users' PCs.

When pushing an app through iTunes to an iOS device connected to a computer, the device performs a check to ensure that the app was indeed acquired from the App Store. This is part of Apple's FairPlay DRM technology.

However, in 2014, a team of researchers from Georgia Institute of Technology presented a method through which an iOS device could be tricked to allow the installation of an app through iTunes that was previously acquired by a different Apple ID.

"Attackers can remotely instruct an already compromised computer to install apps on a connected iOS device, completely bypassing DRM checks," the team of researchers warned at the time. "Even if an app has been removed from the App Store, attackers can still distribute their own copies to iOS users."

According to Palo Alto Networks, this bypass technique still works and was used to install the newly found malicious apps, which the company has dubbed AceDeceiver, on non-jailbroken devices.

More specifically, the attackers first uploaded their apps to the App Store, managing to pass Apple's review process by presenting them as wallpapers. They then purchased those same apps through iTunes and captured the FairPlay authorization code.

The attackers then created a piece of software that simulates iTunes and distributed it in China as a helper program for iOS devices that can perform system reinstallation, jailbreaking, system backup, device management, and system cleaning.

When users connected their devices to a computer with this software installed, it silently installed AceDeceiver on those devices by using the previously captured authorization code. The only indication of the attack was the app icon appearing on the device home screen after the installation was done.

This means that even if the AceDeceiver apps have been removed from the App Store, the attackers can continue to spread them using the PC software because they already have the authorization code they need.

In this case, the attackers tricked users into installing the iTune-like software themselves, but in future attacks, they could do it through malware that silently infects computers through exploits.

"Our analysis of AceDeceiver leads us to believe FairPlay MITM [man-in-the-middle] attack will become another popular attack vector for non-jailbroken iOS devices -- and thus a threat to Apple device users worldwide," the Palo Alto researchers said in a blog post Wednesday.

This is the second time in a month when researchers found rogue apps on the App Store, proving that bypassing Apple's app review process is not only possible, but fairly easy. In both cases, the malicious apps masqueraded as harmless applications and only enabled their malicious functionality when run on devices with IP addresses from China.

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments