Malware Called XcodeGhost Penetrates Apple Defenses and Infects Several Apps

Alex Hern

September 21, 2015

Apple removes malicious programs after first major attack on app store 

Apple has had to remove more than 300 malware-infected apps from its app store after a tainted version of its developer tools led to a number of Chinese apps leaking users’ personal information to hackers.

The company confirmed on Sunday night that it was removing the apps after several cybersecurity firms reported finding a malicious program dubbed “XcodeGhost” that was embedded in hundreds of legitimate apps.

It is the first reported case of large numbers of malicious software programs making their way past Apple’s stringent app review process. Prior to this attack, a total of just five malicious apps had ever been found in the app store, according to cybersecurity firm Palo Alto Networks.

Apple said the hackers embedded the malicious code in these apps by convincing developers of legitimate software to use a tainted, counterfeit version of Apple’s software for creating iOS and Mac apps, which is known as Xcode.

“We’ve removed the apps from the app store that we know have been created with this counterfeit software,” Apple spokeswoman Christine Monaghan said in an email. “We are working with the developers to make sure they’re using the proper version of Xcode to rebuild their apps.“

She did not say what steps iPhone and iPad users could take to determine whether their devices were infected.

The infected version of Xcode achieved its spread due to a quirk of Chinese internet filtering. Due to the country’s widespread censorship of the web, connections to servers located internationally are significantly slower than those situated within China. That leads to Chinese internet users frequently seeking an alternative domestic source for large downloads.

The latest version of Apple’s developer tools, Xcode 7.1, is more than 4GB in size, leading to many Chinese developers downloading versions hosted elsewhere. Some of those versions were infected with XcodeGhost, which inserted the privacy-busting code into the apps.

Advertisement

Ryan Olson, director of threat intelligence at Palo Alto Networks, said the malware had limited functionality and his firm had uncovered no examples of data theft or other harm as a result of the attack.

However, he said it was “a pretty big deal” because it showed that the app store could be compromised if hackers infected machines of software developers writing legitimate apps. Other attackers may copy that approach, which is hard to defend against, he said.

“Developers are now a huge target,” he added.

Researchers said infected apps included Tencent Holdings’ popular mobile chat app WeChat, car-hailing app Didi Kuaidi and a music app from internet portal NetEase. Palo Alto Networks published a list of 39 of the affected apps, while Dutch security firm Fox-IT added its own findings to the list.

Some apps named by the two firms share a name with popular apps used outside China, but appear to be deliberately mis-titled versions of the apps intended to cash in on mistaken downloads.

Chinese security firm Qihoo360 Technology said on its blog that it had uncovered 344 apps tainted with XcodeGhost.

Tencent said on its official WeChat blog that the security flaw affects WeChat 6.2.5, an old version of its popular chatting app, and that newer versions were unaffected. A preliminary investigation showed there had been no data theft or leakage of user information, the company said.

Apple declined to say how many apps it had uncovered, and did not reply to a request for a list of affected apps or details about how many users had downloaded them.