Industry Reactions to XcodeGhost Malware
XcodeGhost, a piece of malware designed to target Apple users, has made a lot of headlines recently after researchers reported finding thousands of infected iOS applications.
Attackers have modified Apple’s Xcode development platform and posted the malicious version on various Chinese websites knowing that many developers in that country prefer obtaining the software from third-party services due to slow download speeds when using Apple’s servers.
The iOS and OS X apps created by developers with the rogue version of Xcode are injected with malicious code that allows attackers to perform various actions, such as collect information from infected devices and open arbitrary websites. Initially, researchers spotted only tens of XcodeGhost-infected iOS apps, but the latest reports indicate that the actual number of affected applications could be as high as 4,000.
Since many of the infected apps made their way to Apple’s App Store, the company has taken steps to remove the malicious programs and released an advisory containing instructions on how developers can ensure that the version of Xcode they are using is legitimate.
Industry professionals contacted by SecurityWeek have shared thoughts on the sophistication and impact of the XcodeGhost attack, supply chain security, and possible prevention and protection methods.
And the feedback begins…
Lance Cottrell, Chief Scientist for Passages, Ntrepid Corporation:
“The XcodeGhost attack on applications in Apple’s iOS store is impressive for its sophistication. Rather than creating their own malware, the attackers were able to trick developers into incorporating malware into their apps. The big trend now is towards launching attacks upstream of the intended victim. In this case the attack focused on application developers to deliver malware rather than trying to deliver it directly. It is similar to malvertising attacks on small companies providing ads to big ad networks, or the Target attack that came in through an HVAC contractor network.
The attack shows both the vulnerability and strength of the walled garden approach to security. Apple failed to identify the malware before placing the applications into the store. Detection is incredibly difficult, so this should not be a huge shock. Fortunately, once identified, Apple is able to quickly remove the malware from every iOS device on the planet. The window of opportunity for the attackers is minimized.
Mass attacks like this are much less concerning than highly targeted attacks. Integrated attacks looking for generic access and information are typically more of an annoyance than a crisis for businesses. Targeted attacks are much harder to detect and are crafted for maximum benefit and/or damage. The recent $1 Million exploit bounty by Zerodium shows just how much these can be worth. The likely buyer for such an exploit would be a criminal or a government. In neither case would it be used in a mass attack but rather kept secret and used for maximum impact against carefully selected targets.”
