Malware Steals 225 000 Logins For Jailbroken iOS Devices

Researchers have discovered malware stole usernames and passwords of 225,000 Apple accounts. The login data are from jailbroken iPhones and iPads. The iOS malware "KeyRaider" and spreads through third-party Cydia app stores in China.

Cydia is the app store where users can download a jailbroken device apps. Besides the official Cydia store, there are third-party stores. This app stores were installed apps to owners of jailbroken iPhone or iPad get additional functionality such as ad blocking, cheating in games, and tuning the system. In reality apps seemed to steal all kinds of information. The stolen information is then used by other users on a jailbroken device to make purchases in the official Apple App Store and in-app purchases to do without paying for it himself.

Furthermore steals KeyRaider also certificates and private keys used by the Apple Push Notification Service and prevents the malware that infected device can be unlocked via a pass code or iCloud service. This latter function uses the malware appliances, as ransomware the computer hostage. Victims have to pay in this case ransom to regain access to their device.

Since the malware only affects jailbroken iPhones and iPads advises security company Palo Alto Networks to non iOS devices jailbreak when it is not needed. According to researcher Xiao Claud, there are currently no Cydia app stores that monitor uploaded apps well. The use of this kind of app stores is therefore at your own risk, says the researcher.

Porn Site Spreads Malicious iOS App Beyond App Store

Owners of both jailbroken and non-jailbroken iPhones are the target of a malicious app distributed on a porn site. The app would be needed for supposedly watching a porn video. After installation, the user is, however, a message that he became a member of the porn site and now have to pay 700 euro or 2100 euro after three days.

To install the app do the scammers may use the Apple Developer Enterprise Program. Through this way it is possible to apps outside the Apple App Store to install. This program costs $ 299 per year and is primarily intended for companies that want to install self-developed applications on the phones of employees. Now it seems that scammers use this way of spreading their fraudulent app.

Before the installation begins, however, the user gets a message that it is an app from an untrusted developer. If the user then chooses the developer still trust the app is installed. Next, the app shows a membership page of the porn site and, after some time that the user has subscribed and to pay now.

For now, the scam would only be directed against Japanese users and there is also an Android variant in circulation.Symantec warns users not to pay the money and remove the app. In addition, Apple has been informed that the developer certificate that the app is signed can be revoked.

Researchers Steal Data From Jailbroken iPhone Via Siri

Researchers have developed a way which makes it possible to steal data from infected jailbroken iPhone via the Siri voice control. When users communicate with Siri is processed their voice to data and sent it to Apple, where the voice input is translated into text.

Researchers Luca Caviglione and Wojciech Mazurczy an attack developed Siri which is used to set up a secret channel between an infected machine and a botmaster so they can steal sensitive data like passwords, credit card numbers and Apple IDs. The malware on the device processes the data to an audio clip that is offered to Siri. Siri will then send the data to a remote server. An attacker who has access to network traffic can thus extract the encoded information.

In addition to the requirement that access to the network traffic, the iPhone must be jailbroken, so the researchers in their report to know. By using the "iStegSiri-attack" can be 0.5 bytes sent per second. Sending a credit card number with 16 digits in this way takes about 2 minutes. The researchers say opposite IEEE they especially want to see how their research steganography, hiding information in innocent looking objects such as images, text or sound clips can be used by attackers.