Apple Responds to Masque Attack Reports: OS X, iOS with Enough Safeguards to Protect Customers

Apple Responds to Masque Attack Reports: OS X, iOS with Enough Safeguards to Protect Customers:

The u.  s. government issued a warning to iPad and iPhone users on November. 13, alerting them of potential attacks by hackers WHO might benefit of a security flaw in Apple's software package.

Apple has gone through security vulnerability issues and says that its iOS and OS X platforms have in-built security measures which will safeguard users.

"We designed OS X and iOS with intrinsic  security safeguards to assist shield customers and warn them before putting in doubtless malicious code. We're not tuned in to any customers that have truly been littered with this attack. we tend to encourage customers to solely transfer from sure sources just like the App Store and to concentrate to any warnings as they transfer apps," Apple processed.

The masquerade Attack vulnerability that exists in iOS might doubtless alter hackers to steal sensitive info. This vulnerability is capable of putting in malware, which might behave like authentic apps. The vulnerability was discovered by FireEye, a security firm.

"This technique takes advantage of a security weakness that enables AN untrusted app -- with a similar 'bundle identifier' as that of a legitimate app -- to switch the legitimate app on AN affected device, whereas keeping all of the user's knowledge," states a bulletin from the U.S. pc Emergency Readiness Team.

According to the bulletin, the safety flaw exists because the Apple software package doesn't impose "matching certificates" for applications that have a typical bundle symbol.

To avoid knowledge compromise, the foregone conclusion is advising mobile device and computer users to refrain from downloading iOS apps that don't seem to be accessible within the App Store. Users also are suggested to not click on suspicious links and dodgy apps thus on not fall victim to phishing scams, additionally as avoid sound on "Don't Trust" messages on AN app that shows "Untrusted App Developer Alert."

Apple advises enterprise users WHO install bespoken apps to put in applications solely via their organization's secure web site.

The masquerade Attack reportedly affects iOS seven.1.1, iOS 7.1.2 and iOS eight and iOS eight.1. The vulnerability, however, isn't microorganism and can doubtless have an effect on users WHO have disabled the default security measures that are engineered into Apple's systems, additionally as those that manually evade the safeguards.

Read more »

Reading this on an iPhone or iPad? WATCH OUT, my friend! Masque Attack!

Masque Attack:

Security researchers have probed additional into the vulnerability in non-jailbroken iOS seven and iOS eight devices that were exploited by the WireLurker malware.

Dubbed a “Masque Attack”, the maneuver permits hackers to put in iOS apps on iPhone or iPad via email or text message. The attack takes advantage of a security weakness that enables associate degree iOS app with a similar filename – no matter developer – to exchange the legitimate app on a post-iOS seven device whereas keeping all of the user’s information.

The overwhelming majority (95 per cent) of all iOS devices area unit doubtless vulnerable, consistent with researchers at security business FireEye.

A demo video place along by FireEye shows however it would be doable to exchange a true Gmail app with a faux utility so as to steal the user’s login credentials, likewise as collect all of their emails.

So the masquerade Attack creates a way to exchange real apps with malware on non-jailbroken iOS devices mistreatment social engineering trickery. masquerade Attacks will happen utterly over the wireless network while not wishing on associate degree infected-computer-to-iThing USB affiliation to unfold WireLurker.

The masquerade Attack conjointly creates a way for hackers to with success skirt the detection by mobile device management code by taking advantage of Apple’s personal Apis, that area unit sometimes reserved for normal iOS apps.

"Apple has been wise to in July 2014 concerning masquerade Attack," an  interpreter told El Reg. "As the way as we all know, they're engaged on a fix."

"This vulnerability exists as a result of iOS does not enforce matching certificates for apps with a similar bundle symbol and also the assailant will craft the message shown to the user at install time,” the interpreter continuing. “After the malware replaces associate degree authentic app, the authentic app's native information weren't removed and this information were accessible to the malware."

"Wirelurker is that the initial proverbial malware mistreatment the masquerade attack. luckily, it hasn't conducted additional powerful attacks," she other.

FireEye's public unharness of data concerning the masquerade Attack comes days once the invention of WireLurker, the primary malware capable of spreading onto non-jailbroken Apple iOS devices from infected raincoat OS X systems.

If WireLurker cask up the wide command assumption that non-jailbroken iPhones and iPads were immune from malware, then the discharge of data concerning the masquerade Attack additional stirs the pot.

Pending the supply of a patch from Apple, FireEye advises iThings users to solely install apps from Apple’s official App Store or the user’s own organization, among alternative precautions.

Jeremy Linden, senior security product manager at mobile security firm Lookout, aforementioned that the masquerade Attack diagrammatical a modification in the direction in wherever threats would possibly return from and appearance like.

“In the past these sorts of vulnerabilities concerned dropping associate degree app on your phone, however one issue that’s new concerning masquerade Attack is that it uses associate degree icon that’s already on your phone and replaces the app behind it," Linden commented. "If you only saw a random banking app on page five of your iPhone, you’re not planning to be desperate to click it and enter your login credentials. however, if you’re already trusting this icon, you might. Classic social engineering at play."

Linden aforementioned that there have been a variety of mitigating factors, in the main the requirement for associate degree assailant to "obtain associate degree enterprise provisioning profile or steal one, neither of that area unit trivial".

In addition, there would conjointly perpetually be a warning to the user, that ought to look suspicious as a result of it’s not one thing you'd unremarkably see in iOS

Read more »