Apple Removes Infected Apps From App Store

Apple has malware-infected apps from the App Store removed after investigators here last week warned. The apps were created with an infected version of Xcode, Apple's official tool for developing apps for iOS or OS X.

Several Chinese developers had downloaded an infected version of the development software through unofficial download sites, which then also developed apps became infected. The malware in apps called XcodeGhost is able to send information about the device and apps and can try different ways to steal passwords. Thus the malware on the device can display a warning dialog box where users enter their login details and the contents of the clipboard can be read and modified.

The infected apps were both in the Chinese App Store and the App Stores offered in other countries. "We have the apps from the App Store away that we know that are made ​​with counterfeit software," a spokeswoman told news agency Reuters. "We are working together with the developers to ensure that they use the correct version of Xcode to make their apps again." What iPhone and iPad users can do to see if their device is infected Apple has not said. Also, Apple does not report how many apps it has been removed, but the Chinese security company Qihoo argues that the total of 344 with XcodeGhost infected apps found.

Dozens Of Malware Infected Apps In App Store Discovered

Researchers in the official Apple App Store dozens of malware infected apps discovered, reports security company Palo Alto Networks. The malware sends information about the device and the infected app to the attacker and can receive remote commands from the attacker.

Through these assignments, the malware can show an alert box that attempts to steal login information. Also, certain URLs can be hijacked and it is possible to read data in the clipboard of the user and adapt. In this way, pirated for example, passwords can be stolen. The malware XcodeGhost mentioned. Xcode is Apple's official tool for developing apps for iOS or OS X.

At various Chinese websites and forums were posted links to an infected version of Xcode. These infected version was downloaded again by Chinese developers and used to develop their apps. However, the infected Xcode version added to the malware apps, which were then placed by the developers in the App Store. According to analyst Claud Xiao some developers choose to make because of the slow internet in China nearly 3GB large Xcode not be downloaded directly from Apple, but through unofficial download sites.

At first it seemed to be two infected apps that were offered only in the Chinese version of the App Store. Now Palo Alto Networks announced that it has detected 39 infected apps, including apps for banking, stock trading, instant messaging and games. These include to WeChat, developed by the Chinese Internet giant Tencent, Didi Chuxing, a kind of Uber-like app and China Railyway 123 036, the only official app in China for purchasing train tickets.

Some of the apps developed by Chinese developers are also available on the App Store from other countries, such CamCard and WeChat. The infected apps have been downloaded by millions of people. The Dutch company Fox-IT checked the domain names used by the attackers and discovered much more infected apps, including Winzip and PdfReader. In total hit Fox-IT more than 50 infected apps on.

Visitors Uber-Petition Sent Via Leakage To Competitor

Vulnerability in a petition page of taxi app Uber made it possible for the researcher who discovered the problem visitors could forward it to competitor Lyft. Uber was on its website a petition initiated by users of the app were called to signs.

Researcher Austin Epperson also received the request and immediately discovered that there were all sorts of characters could be completed in the petition form. The problem was compounded by the petition page the last five signed petitions were presented. Epperson He further discovered that could add an iframe to be completed petition, which he visits automatically competitor Lyft.com sent it. Visiting the petition in this case was sufficient to be forwarded. According to the researcher, however, had the leak can be used for far more dangerous things, such as spreading malware or defrauding visitors through a scam page.

To ensure that his petition with code still on the page appeared Epperson discovered another problem, which he eventually using a program 1,000 petitions able to fill every minute. "I stopped when the count had reached 106,000 signatures," so let him into an explanation of the problems found knowledge. After being informed by the investigator Uber took the site from the air, which at the time of writing is still not online. Epperson further states that the developer of the petition page script one-to-one copied from an online manual, which is precisely that it is a simple contact form.

Great Email Service SendGrid Hacked Account Via Employee

The major e-mail service SendGrid, which include e-mails sent to Pinterest, Uber, Foursquare, Hootsuite and Spotify, has warned customers that their data may be stolen. On 8 April, the SendGrid account of Coinbase hacked , a large Bitcoin exchange, and used to send phishing emails. At first thought SendGrid that it was an isolated incident.

Further investigation revealed that the account was hacked by a SenGrid employee and was used by a cyber criminal to approach various internal systems. These systems contained user names, email addresses and customize stretched and saved passwords. The cyber criminal could access servers with e-mail lists and addresses received from customers of the customers SendGrid. In theory, it could go to millions of users.

According SendGrid there is no evidence that this data is also captured. However, as a precaution decided to reset the passwords of all customers. In addition to resetting the passwords SendGrid customers will also generate their DKIM keys again. DKIM is a digital signature that verifies the domain where the emails were sent from. Because of the new DKIM keys will also be the DNS of the domain name must be modified. How not know the account of the employee could be hacked SendGrid late. However, the e-mail service will tighten security.

Security Chef Facebook Is At Uber Started

Joe Sullivan, the former security chief of Facebook, go to taxi Uber app to work, as the company announced on its website. Sullivan was five years as Chief Security Officer at Facebook and was actively involved in other rolling out a rewards program for researchers discovered vulnerabilities in the social networking site. Previously, he worked at eBay.

At Uber Sullivan will investigate the security of the app and data from operators and drivers, but possibly with the use of new security technologies and privacy. "We not only see opportunities in technology, through biometrics and monitoring of drivers, but also the potential to work with cities and governments around the world," says Uber CEO Travis Kala Nick, who while noting that Uber mainly on user privacy will focus ..

Sullivan says that he plans to the lessons he learned at eBay and Facebook to apply at the Uber and act as a bridge between the digital and physical world. "There is already a good security foundation present, it is my goal to make it even stronger." In late February made ​​Uber yet known that last year a third party had gained access to the database of the company, and the names and license numbers of 50,000 drivers were requested.

Tinder plagued by spam bots

A number of users of dating app Tinder reports that they are matched a fake profile of an attractive woman.In reality the automated bots that users want to download. Mobile game "Castle Clash"

The bots display a link to the game via the URL "Tinderverified.com", making it seem like Tinder is the owner of the URL, or is involved in any case in one way or another to the action. This is not the case.

A Reddit user realized what was happening and posted a screenshot. This post now has a handful of responses from others who say they have experienced the same. Also on Twitter More and more reports from people who claim they are matched with a fake profile.

The bot first sends innocent messages like "hey" and "how are you?" then they tell the unsuspecting user that they have such a fun game on their phone, "Castle Clash, have you heard of?" The bot then informs the URL, no matter what was the response of the user.

It is still unclear who exactly is behind the fake accounts, even though the app developer IGG.com course obvious. The company offers dozens of games on the App Store and Google Play. However, it is also possible that the developer himself the victim of an aggressive promotional network as previously happened with the on-demand ride service Uber .

Tinder shows himself to be aware of the problem and said the necessary steps to remove the spam.

Symantec Detailed Report