XcodeGhost - Mobile Malware on the rise....

We attended a Gartner Security Event last week, where in one session  the topic of Mobile Malware was raised. The general perception was that Mobile Malware is not a major problem and that iOS devices are immune.

A new threat has just been detected which severely affects iOS devices called XcodeGhost.  This threat came about as a result of malicious code incorporated into a counterfeit version of Apple's programming software which is used by software developers to develop applications for Apple's App Store.

If you haven't thought about protecting your company's mobile devices then now is definitely the time.

Wandera’s Secure Mobile Gateway has already detected 36 infected applications across thousands of devices which makes XcodeGhost the highest profile iOS based threat identified so far.

The Wandera Threat Research Team has produced a Threat Advisory report outlining the threat and detailing how the attack takes place, and how the Wandera Secure service is able to protect your devices from the infected apps.

What is XcodeGhost?

The XcodeGhost malware is malicious code,  which is inserted into iOS applications using a rogue version of Apple’s own Xcode, allowing the hacker to steal valuable data from the infected device. The creators were able to manipulate Xcode and make it readily available to any developer looking to build an iOS application. We understand that in particular Chinese developers have used the malicious Xcode believing it to be genuine, and as a result unknowingly incorporated malicious code into their app code bases.

Could I be affected?

If you are a Wandera customer, our Secure Mobile Gateway will block mobile data from being stolen off an employee device by the malicious apps whilst also scanning for any new infected apps. Current apps that have been infected include the popular enterprise applications CamCard and WeChat.

Does Wandera protect me against this?

The Wandera Secure Mobile Gateway has already successfully identified this threat across 36 different apps and any customers who have deployed the ourSecure Mobile Gateway will be actively protected against the XcodeGhost threat.

Until today, most users have assumed that the app store was free of all mobile malware. This further demonstrates what security researchers have known for some time, that like other mobile platforms, Apple devices are also at significant risk from the rise of mobile malware and a defence in depth approach including user education is required.

Our security researchers have notified Apple of our findings and are continuing to actively monitor the situation.

Written by

Kévin Navette ☁