BEIJING—Some of the most popular Chinese names in Apple Inc.'s
App Store were found to be infected with malicious software in what
is being described as a first-of-its-kind security breach, exposing
a rare vulnerability in Apple's mobile platform, according to
multiple researchers.
The applications were infected after software developers were
lured into using an unauthorized and compromised version of Apple's
developer tool kit, according to researchers at Alibaba Mobile
Security, a mobile antivirus division of Alibaba Group Holding
Ltd.
The list of recently compromised iPhone and iPad apps includes
Tencent Holdings Ltd.'s popular mobile chat app WeChat, Uber-like
car-hailing app Didi Kuaidi, and a Spotify-like music app from
Internet portal NetEase Inc.
The attack affected more than three dozen apps, according to
U.S.-based cybersecurity firm Palo Alto Networks Inc.
The infected apps can transmit information about a user's
device, prompt fake alerts that could be used to steal passwords to
Apple's iCloud service, and read and write information on the
user's clipboard, according to researchers.
Apple said in a late Sunday statement that it had taken steps to
address the problem. "To protect our customers, we've removed the
apps from the App Store that we know have been created with this
counterfeit software and we are working with the developers to make
sure they're using the proper version of Xcode to rebuild their
apps," the statement said.
In separate statements posted to social media over the weekend,
Tencent, Didi Kuaidi Joint Co. and NetEase said their applications
had been compromised but said no sensitive customer information had
been lost.
"At present, we haven't discovered any loss of user information
or assets as a result of this [breach], though the WeChat team will
continue to monitor and do tests," Tencent said in a note posted to
the Sina Weibo microblogging service late Friday. A new, clean
update of the WeChat app had been uploaded to the app store, it
said.
It is unusual for malware to spread through Apple's App Store,
which typically subjects apps to stringent reviews. In a blog post
Thursday, Palo Alto Networks said the attack was the first of its
type directed at Apple's iOS mobile operating system. Chinese
anticensorship activist group Greatfire.org called it "the most
widespread and significant spread of malware" in the app store's
history.
Asked if it was possible the Chinese government was involved,
Palo Alto Networks said it didn't yet have enough information to
determine who was behind the attack.
Other apps found infected with the malware include those
belonging to state-run mobile carrier China Unicom, and 12306, the
country's official train-booking website, researchers said. China
Unicom and China's railway bureau didn't immediately respond to
requests for comment Sunday.
It wasn't clear Sunday how the infected apps made it past
Apple's screening process, or whether the breach had resulted in
any user information being stolen, though researchers said millions
of devices could have been exposed based on the popularity of the
apps in question.
WeChat has more than 500 million active users, according to
Tencent. It isn't clear how many use devices from Apple, which
accounts for about 15% of China's smartphone market, according to
researcher IDC.
The hack exploited Chinese developers' impatience, according to
Palo Alto Networks. To write apps for Apple devices, developers
have to use a tool kit called Xcode, but downloading the official
version from Apple's website can take a long time in China.
The hackers posted their infected version on a Chinese server,
advertising faster downloads, the researchers said. Any app created
or altered using the bogus Xcode would then become infected with
the malware, they said.
The infected Xcode was hosted on Baidu Pan, a cloud service
offered by Chinese search company Baidu Inc., said multiple
security researchers.
Baidu removed the file shortly after being notified of its
existence, Baidu spokesman Kaiser Kuo said Sunday.
The malware has been dubbed XcodeGhost by Alibaba Mobile
Security researchers, who were the first to document it extensively
in a series of social-media posts starting Thursday.
Even if the hackers didn't use the malware to steal anything,
Palo Alto Networks warned it still represented a threat to the
popular operating system. Security researcher Claud Xiao wrote on
the firm's website Friday that criminals and spies could use the
malware to gain access to iOS devices.
"We believe XcodeGhost is a very harmful and dangerous malware
that has bypassed Apple's code review and made unprecedented
attacks on the iOS ecosystem," he wrote.
Yang Jie and Danny Yadron contributed to this article.
Write to Josh Chin at josh.chin@wsj.com
Access Investor Kit for "Apple, Inc."
Visit
http://www.companyspotlight.com/partner?cp_code=P479&isin=US0378331005
Subscribe to WSJ: http://online.wsj.com?mod=djnwires
(END) Dow Jones Newswires
September 20, 2015 21:05 ET (01:05 GMT)
Copyright (c) 2015 Dow Jones & Company, Inc.
Baidu (NASDAQ:BIDU)
Historical Stock Chart
From Aug 2024 to Sep 2024
Baidu (NASDAQ:BIDU)
Historical Stock Chart
From Sep 2023 to Sep 2024