Apple malware affects mostly Chinese users

14:27

Malware has bypassed Apple's safety controls by taking advantage of a process used by employers to add apps to workers' iPhones and iPads.
US-based Palo Alto Networks said WireLurker appeared to have originated in China and was mostly infecting devices there.
The malware first targets Mac computers via a third-party store before copying itself to iOS devices.
Researchers warn it steals information and can install other damaging apps.
"WireLurker is unlike anything we've ever seen in terms of Apple iOS and OS X malware," said Ryan Olson, Palo Alto Network's intelligence director.
"The techniques in use suggest that bad actors are getting more sophisticated when it comes to exploiting some of the world's best-known desktop and mobile platforms."
WireLurker has the ability to transfer from Apple's Mac computer to mobile devices through a USB cable.
The malware initially gets onto an iOS device via a USB link to an infected Mac computer
The security firm said the malware was capable of stealing "a variety of information" from mobile devices it infects and regularly requested updates from the attackers' control server.
"This malware is under active development and its creator's ultimate goal is not yet clear," the company added.
Apple has issued a brief statement.
"We are aware of malicious software available from a download site aimed at users in China, and we've blocked the identified apps to prevent them from launching," it said.
"As always, we recommend that users download and install software from trusted sources."
Work apps
According to Palo Alto Networks,WireLurker was first noticed in Junewhen a developer at the Chinese firm Tencent realised there were suspicious files and processes happening on his Mac and iPhone.
Further inquiries revealed a total of 467 Mac programs listed on the Maiyadi App Store had been compromised to include the malware, which in turn had been downloaded 356,104 times as of 16 Oct.
Infected software included popular games including Angry Birds, The Sims 3, Pro Evolution Soccer 2014 and Battlefield: Bad Company 2.
Once the malware was on the Mac, it communicated with a command-and-control server to check if it needed to update its code, and then waited until an iPhone, iPad or iPod was connected.
When an iOS device was connected the malware would check if it was jailbroken - a process used by some to remove some of Apple's restrictions.
If it was jailbroken, WireLurker backed up the device's apps to the Mac, where it repackaged them with malware, and then installed the infected versions back on to the iOS machine.
If it was not jailbroken - which is the case for most iOS devices - WireLurker took advantage of a technique created by Apple to allow businesses to install special software on their staff's handsets and tablets.

You Might Also Like

0 comments