Espionage app targets iOS devices

Trend Micro has discovered an interesting poisoned pawn - spyware specifically designed for espionage on iOS devices. While spyware targeting Apple users is highly notable by itself, this particular spyware is also involved in a targeted attack.

The iOS malware found is among those advanced malware and it is believed the iOS malware gets installed on already compromised systems, and it is very similar to next stage SEDNIT malware Trend Micro found for Microsoft Windows’ systems. Two malicious iOS applications were found in Operation Pawn Storm. One is called XAgent and the other one uses the name of a legitimate iOS game, MadCap. XAgent is designed to work specifically with iOS7, which is still in one of every 5 iPhones and iPads. Fortunately, for iOS 8 devices, the user will see multiple notifications that the phone is trying to install an app. And it can’t run without the user launching. Both tools have the ability to record audio, which is very intrusive, and highly suggests the targeting of offline and confidential information.

Following analysis, Trend Micro concluded that both are applications related to SEDNIT – which is a spyware that aims to steal personal data, record audio, make screenshots, and send them to a remote command-and-control (C&C) server. Some of the data theft capabilities include:

• Collect text messages
• Get contact lists
• Get pictures
• Collect geo-location data
• Start voice recording
• Get a list of installed apps
• Get a list of processes
• Obtain Wi-Fi status

There may also be other methods of infection that are used to install this particular malware. One possible scenario is infecting an iPhone after connecting it to a compromised or infected Windows laptop via a USB cable.

For a more detailed analysis of the spyware, read here.

Background of Operation Pawn Storm
Operation Pawn Storm is an active economic and political cyber-espionage operation that targets a wide range of entities, like the military, governments, defense industries, and the media.

The actors of Pawn Storm tend to first move a lot of pawns in the hopes they come close to their actual, high profile targets. When they finally successfully infect a high profile target, they might decide to move their next pawn forward: advanced espionage malware.

The iOS malware we found is among those advanced malware. We believe the iOS malware gets installed on already compromised systems, and it is very similar to next stage SEDNIT malware we have found for Microsoft Windows’ systems.

“The new iPhone 6 recharges with two minutes in the microwave”: A new urban myth about Apple

Remember when some Apple users ‘lost’ their phones after believing stories about the iOS7 making the iPhone waterproof?

After the presentation of the latest new features in Apple devices and the new iOS8 operating system, the Internet is full of articles either in praise of or criticizing the company’s latest efforts. Users, eager to find all the latest information and the best tips on how to get the most from the new iPhone 6, scour forums and blogs to stay up-to-speed with everything about these new releases.

That’s why it’s no surprise to find these types of practical jokes doing the rounds on the Web, or to encounter some poor unsuspecting user, who perhaps expecting more than is reasonable from the new device, falls for the trick.

This story took the form of an advert, similar in style to the one launched by Apple on 4chan, announcing the new ‘Wave’ feature of iPhone, which could supposedly recharge the phone in the microwave.

click to enlarge

So do you believe everything you read on the Internet?

iPhone 6 Launches Millions of Scam Messages

The new iPhone 6 has gone on sale around the world, sparking long lines and campouts, and a whole lot of buzz. Unsurprisingly, internet scammers quickly took advantage of the frenzy to distribute their wares.

Immediately following the unveiling of the new iPhone 6 and iPhone 6 plus, scammers accordingly began circulating email and web scams attempting to capitalize on its popularity. The gambits however take many forms.

For instance, Hoax-Slayer uncovered a bogus Facebook competition offering the ability to “win a new iPhone 6 by carrying out three easy steps.” To get a chance to win, the site claims that users must first like the site's Facebook Page and then further promote the site by sharing a link with Facebook friends. They are then instructed to go to a second page on the site to download a ‘Participation Application.’ But, a pop-up window will direct users to a list of links that open third-party survey websites.

And here’s where the real malicious activity starts: many of these ask users to submit their mobile number, which, in turn, will subscribe them to a premium SMS service that charges several dollars every time the scammers send the victim a message.

Others collect names, addresses and phone details, which can be used for a variety of nuisance campaigns.

“Meanwhile, the scammer who created the fake promotion will earn a commission via a suspect affiliate marketing scheme each time you fill in a survey and provide your details,” Hoax-Slayer explained. “And, each time you return to the download page, the pop-up will inform you that the survey was not completed properly or there was a 'small error'. You will be urged to participate in yet another survey. But, no matter how many surveys you complete, you will still not get to download your 'application'.”

In one of the many other campaigns, spammers are using an iPhone 6 giveaway email to lure in potential victims; they are asked to follow instructions in the email to click on a link to, yet once again, a survey, but instead, an adware install will commence. Since Sept. 12, AppRiver researchers have seen nearly 1 million messages associated with this specific campaign.

“Adware is a form of software that is meant to generate revenue for its author by automatically displaying advertisements,” explained AppRiver researcher Troy Gill, in a blog. “Adware is not typically anything more than an annoyance but can often seriously infringe on users' privacy. This particular strain has a wide array of functionality and can make a victim’s web browsing experience fairly miserable.”

These types of scams, of course, also carry the possibility of malicious activity in the form of man-in-the-middle attacks, malware deployments and phishing.

“Though its presence is not secret, it is quite good at embedding itself into the victim’s system and can be quite difficult for the average user to remove,” Gill said. “Remember, advertisements promising you something for nothing are almost always too good to be true.”

AppBuyer iOS Malware Steals Apple ID, Password & Buys Apps

Researchers from Palo Alto networks have discovered an iOS malware sample that affects iPhone devices that are jailbroken. The malware is named ‘AppBuyer’.

Photo: blvdone / Shutterstock

The AppBuyer malware is created and set up in a way that it will steal the user’s Apple ID login and password. Once these credentials have been stolen, the malware will purchase specific applications from the App Store and those behind the malware are utilizing the iOS environment to make some serious money.

The hackers first infect the device, and when it has been hacked, the device uploads Apple ID credentials. Once the hackers have access to the credentials, they are able to buy specific applications that may generate attractive revenue for the hackers.

The members of the WeiPhone Technical Group, who first mentioned AppBuyer in May, remotely assisted a user in finding out why some apps were periodically installed to his jailbroken device, and later found two strange files on the phone.

They discovered that the suspicious files would execute, download and delete other executable files from the web. They also tried to identify the hacker through analyzing the C&C server’s domain name with the samples. They also released samples for downloading.

WeiPhone Technical Group didn’t give a reason for how the samples were installing other apps into infected devices. On the other hand, the C&C servers are up and running, which may impact a greater number of users.

Palo Alto Networks analyzed the samples to disclose its working and provide suggests and solutions to defeat it. The researchers, however, still don’t know how the malware was installed on jailbroken Apple devices.

There are some possibilities that include via a malicious Cyber Substrate tweak that is hosted in third-party Cydia sources, through a PC jailbreaking utility, through other PC malware, or some other unknown way possibly.

After a device has been infected, the malware will first download executable files to generate a unique UDID. Then it will download a Cydia Substrate tweak for intercepting all HTTPS/HTTP sessions for stealing the Apple ID and password of the user and uploading to the attacker’s server.

Lastly, it will download a fake gzip utility that will login to the App Store through the user’s Apple ID credentials, and buy additional apps. Palo Alto Networks researchers, therefore, identify AppBuyer as a Trojan.

Defense

Palo Alto Networks researchers highly recommend iOS users to stay away from jailbreaking. They mention AdThief, another iOS malware discovered this year, infecting more than 75,000 devices. Another example is Unflod, a malicious Cydia Substrate tweak that steals the Apple ID credentials of the victim in a similar way.

For users who have already jailbroken their iOS devices should look for one or a combination of the following files in their device file system:

• /System/Library/LaunchDaemons/com.archive.plist
• /bin/updatesrv
• /tmp/updatesrv.log
• /etc/uuid
• /Library/MobileSubstrate/DynamicLibraries/aid.dylib
• /usr/bin/gzip

If there is any such file, the device may be infected by AppBuyer malware. However, just removing these files may not solve the issue as there is no word on how the malware actually got into the device. The Palo Alto Networks Platform says it can protect the malware in several ways.

They have already released signature URLs to prevent the download of the mentioned malicious files, and soon they will be releasing IPS and DNS signatures. The new iOS malware can be essentially deleted by blocking AppBuyer’s executable files from downloading. 

'Apple Pay' is a Touch ID-based mobile wallet included with iPhone 6, rolls out in October

Apple will enter the mobile payment space in a big way with this month's launch of the iPhone 6 and iPhone 6 Plus, both of which will ship with integrated near-field communications technology to allow secure wireless payments through a service called Apple Pay.

In unveiling Apple Pay, Apple Chief Executive Tim Cook noted that current credit cards are not secure, featuring exposed numbers and "outdated and vulnerable" magnetic stripes. Apple Pay aims to solve this by securely holding banking and card information on a user's iPhone 6 or iPhone 6 Plus.

In showcasing Apple Pay, Apple executive Eddy Cue noted that the company won't know what the user bought, how they bought it, or how much they paid for it. The details of the transaction are entirely between a user and their bank.

Apple has partnered with American Express, MasterCard and Visa for digital debit cards and credit cards. In addition, the six biggest issuing banks in the U.S. are on board, representing 83 percent of credit card volume in the U.S.

The new system will work with 220,000 locations that allow contact-less payments. And Apple says its method is more secure because cashiers don't get to see a customer's name, credit card number or security code.

Apple Pay will launch in the U.S. next month, though Apple is planning to roll out in more countries soon.

Apple just added another layer of iCloud security, a day before iPhone 6 event

Apple said it was beefing up security after last week's nude celebrity hack, and now it looks like the company is following through on its promise. MacRumors is reporting that the company has begun sending out alert emails whenever iCloud accounts are accessed through a web browser. Notably, the alerts aren't triggered when the service detects a new browser; they are sent even when the specific browser has already been used to access the account.

Because iCloud is typically used to link apps, browser logins are now being treated as unusual enough to warrant an alert by themselves.

These alerts wouldn't prevent hacks, but they would provide an earlier indication that an account had been compromised, making it easier to stop hacks in progress and potentially trace back whoever is trying to break into the account. It's also an important sign that Apple is turning new attention to iCloud, which has many in the industry have seen as a neglected part of Apple's otherwise seamless infrastructure.

It's also an interesting move in the run up to Apple's event tomorrow, which many expect will bring new 
features to iCloud.