中国流行的iOS应用遭到前所未有的恶意软件感染
发生了什么?
据最近的报道,中国开发者使用的某些版本的Xcode被感染,在开发者不知情的情况iOS应用中就被注入了用于跟踪的代码。(1、2)。被注入后,开发者们将他们被感染的iOS应用程序的上架了App Store并得到苹果批准。截止完稿前,这些被感染的应用在App store仍可访问(外部链接)。任何安装并启动了这些被感染应用的用户都将是追踪代码的受害者。
这是苹果应用商店一次重大的感染事件。苹果以人工审查所有的被提交应用而著名,相对Android商店的恶意软件会更多。这是苹果应用商店历史上最广泛和重大的一次恶意软件事件传播事件。
这些被感染Xcode被托管在百度云上。百度本身似乎并没有意识到这些Xcode是被感染的。在这次事件逐渐浮出水时该公司于昨日删除了这些被感染的文件。由于在中国下载外国网站的文件时速度非常慢,许多中国人希望能够从国内网站来下载。很多人也会使用下载软件,如迅雷,而不是直接从官方的Mac App Store中下载。
据用户的报告,许多中国著名的应用受到影响。我们在下面的列表中链接了测些受感染的应用,但请不要下载他们,我们只是链接他们,目的是使用户能够知道具体是哪些应用程序。这些受影响的应用程序包括:
微信(link is external) 中国最流行的聊天应用
网易云音乐(link is external) (NetEase Cloud Music) - 网易的免费音乐应用
网易公开课(link is external) (NetEase) - 被许多学生所使用的公开教育应用
中信银行动卡空间(link is external) (China CITIC Bank Card Space)
中国联通手机营业厅(link is external) (China Unicom Shop)
滴滴出行(link is external) (DiDi travel) - 流行的打车应用
12306(link is external) - 中国官方的火车票务应用
高德地图(link is external) (Auto-Navigation)
要注意,其中网易的两个应用是网易官方出品的。网易是中国最大的互联网公司之一。微信是中国最流行的聊天应用。中国联通是中国主要的电信公司之一,中信是中国最大的银行之一。这些应用程序几乎都是最流行的,并且受到用户的高度信赖。这些公司的开发商无视数字签名的警告并继续使用被感染Xcode是非常不负责任的行为。如果该恶意软件的作者对微信或中信进行有针对性的攻击,他就能够从中获得用户凭据,搜集聊天记录,联系人列表,甚至是银行账户的详细信息!
网易已经发布了对网易云音乐用户的警告:
微信也表明已知晓此问题:
已经被感染的用户如何才能减轻这种影响?
如果你是一个iPhone用户,这有一些你可以做的:不要下载上面的应用。除非绝对必要,否则不要给应用授予权限。启用Apple ID的两步验证(链接外部)。尽管现在这个恶意软件的目的似乎并不是Apple ID,但是更为激进的恶意软件有可能在将来会显示一个假窗口,来骗取登录凭证。据topaloaltonetworks所称,该恶意软件当前的影响有:
-
当前时间
-
目前被感染的应用程序名称
-
该应用程序捆绑标识符
-
当前设备名称和类型
-
当前系统的语言和国家
-
当前设备的UUID
-
网络类型
如果你是一个iOS开发者,你有很多需要做来确保您的开发系统安全:
-
始终从官方的Mac App Store下载Xcode。其他的开发工具也一样,保证要从官方渠道下载。
-
始终要检查的开发工具的数字签名。忽视签名警告的开发商是不负责任的。Xcode显然已经由苹果签名,所有其他的版本都会产生警告。
-
将开发系统与您的日常系统隔离开。开发系统应只用于开发,而不是浏览其他网站。如果物理隔离有困难,对于开发商来说最起码应该使用一个专用的用户帐户。
苹果应该怎样做,来减轻这些感染?
苹果应该立即扫描其整个App Store来寻找恶意软件的特征,并删除所有受影响的应用程序。
苹果的Gatekeeper应当对应用程序启用预加载列表来强制签名验证。例如,如果Xcode和其他关键应用的签名无效,操作系统不应允许用户绕过,并继续安装。 (这个想法是类似于HSTS预载,来防止网络攻击。)
我们已要求苹果这种情况下解释他们的缓解策略,并计划出他们为未来的防御机制,以避免这一情况重演。
谁是幕后黑手,为什么会有人制造感染?
CoderFun首次开始发布感染的Xcode在大约5个月前。
似乎这个特定的恶意软件是被用于收集设备信息来进行数据挖掘。但是,恶意软件可以被用来更加积极地收集隐私信息,例如联系人,照片,甚至icloud的密码。它可以通过钓鱼并结合其他规避机制来应对人工审核。
引用:
http://drops.wooyun.org/news/8864(link is external)
http://weibo.com/1708947107/CAVdJ8Epo?from=page_1005051708947107_profile&wvr=6&mod=weibotime&type=comment#_rnd1442530292827(link is external)
评论
Thanks for covering this important security issue. The WeChat team has recently posted an update about their response to the issue and it would be great if you could amend your article to include the response. Find the official English response here: http://blog.wechat.com/2015/09/19/fixed-security-flaw-in-wechat-v6-2-5-f...
Nice one. Check out my blog too.
top movie streaming sites
4do.se
nf lksjn lfw
Shaandaar Full Movie Download
s lfljkb oibjk
Happy New Year 2016 Wishes
v gyvjubjhkgh nj
Happy Diwali 2015 Wishes
sf sdkjbjsb jksbkj
Happy Diwali 2015 Images
http://www.happydiwali2015.science/2015/09/happy-diwali-2015-special-wha...
http://www.happydiwali2015.science/2015/09/happy-diwali-2015-images-gree...
http://www.happydiwali2015.science/2015/09/happy-diwali-2015-wishes-in-h...
http://www.happydiwali2015.science/
http://www.happydiwali2015.science/
http://www.happydiwali2015.science/
http://www.happydiwaliimagesandwishes.in/diwali-greeting-cards/
http://www.happydiwaliimagesandwishes.in/happy-diwali-quotes-2015/
http://www.happydiwaliimagesandwishes.in/diwali-rangoli-designs/
http://www.happydiwaliimagesandwishes.in/diwali-offers-2015/
http://www.happydiwaliimagesandwishes.in/diwali-gift-ideas-2015/
http://www.happydiwaliimagesandwishes.in/diwali-sweets-2015/
You all lovePlayBox HDApp
thanks for sharing
check my site here: galaxy s7
lg g5
Sony Xperia z5
techsradar
htc one m10
latest wallpaper 2015
android apps
techewire
Happy Diwali 2015
diwali messages
happy diwali messages
happy diwali messages greetings
Christmas 2015 Messages
Christmas 2015 Quotes
my websites :
فتح المواقع المحجوبة
سايفون اندرويد
برنامج أبو هلال
شركة مكافحة حشرات بالرياض
شركة رش مبيدات بالرياض
شركة مكافحة حشرات بالدمام
شركة رش مبيدات بالدمام
شركة تنظيف بالرياض
شركة تنظيف فلل بالرياض
شركة تنظيف خزانات بالرياض
شركة تنظيف منازل بالرياض
شركة نقل عفش بالرياض
شركة تنظيف بالدمام
شركة تنظيف شقق بالدمام
شركة تنظيف فلل بالدمام
شركة تنظيف بالطائف
شركة تنظيف بتبوك
Super
imo for pc
imo for windows
imo .im
imo for pc
can you tell me the release date of iphone 7
Showbox app
Best 100 whatsapp status
How to Login Hotmail account
Whatsapp for PC
Kik Login
thanks Photo Grid For PC .
I agree with your article. thank you for giving info. Obat Maag
I love Iphone 6s wow it's just awesome
money lender Singapore
Singapore Money Lender
AgaricPro Obat Herbal Untuk Bermacam Penyakitadalah salah satu obat herbal yang sangat ampuh untuk mengobati berbagai penyakit seperti Obat Sinusitis. terbuat dari ramuan herbal yang sangat berkualitas dan terjamin, dapat juga menyembuhkan penyakit seperti penyakit Agaricpro | Obat Maag. Jika Anda tidak menyukai obat kimia, jangan khawatir karena produk kami terbebas dari bahan kimia, jadi AgaricPro | Obat Asma dapat disembuhkan dengan produk kami. Produk best agaric AgaricPro Sebagai Solusi Untuk Hidup Lebih Sehat, AgaricPro Untuk Mengatasi Berbagai Macam Penyakit dengan kualitas yang sangat tinggi ini mampu menyembuhkan penyakit-penyakit yang ganas seperti penyakit AgaricPro | Obat Hematuria. Banyak orang yang sudah menggunakan produk kami dan memberikan testimoni positif, karena produk kami memberikan efek yang sangat besar untuk menyembuhkan penyakit AgaricPro | Obat Asam Urat. Produk kami bisa didapatkan di Tasik Store. Jika Anda mempunyai keluhan tentang kewanitaan, maka Obat Keputihan Crystal X adalah solusinya. tidak hanya penyakit AgaricPro | Obat Stroke tetapi juga bisa menyembuhkan penyakit AgaricPro | Obat Liver. Jika anda mempunyai keluhan wanita, seperti keputihan maka Nes V | Obat Keputihan sulusinya untuk Penyakit Wanita dan Obatnya . Mulailah dari sekarang untuk hidup Healthy Life Indonesia . Segeralah lakukan pengobatan jika Anda mempunyai keluhan AgariPro |Obat Kurang Darah , karena jika dibiarkan penyakit Anda akan semakin parah. AgaricPro | Obat Hernia dan juga AgaricPro | Obat Kolesterol. Dengan kualitas yang aman ampuh dan terjamin bisa menyembuhkan berbagai penyakit Jantung, Maag, Rematik. Obat Penyakit Asam Urat Ampuh
nice thanking you
new year images
Golden Globe Awards 2016 Live Stream || @ On January 10, 2016 set the date for the 73rd Annual Golden Globe Awards by The Hollywood Foreign Press.
http://goldenglobeawards2016livestream.com/
Justin Bieber Tickets Tours & Concert Updates
http://justinbieberconcert.co/
Knock! Knock! Knock!!! Hello……!!!! We are back with a big bang award show which is Golden Globe Award 2016. Great show, some great people, beautiful and spectacularly talented actresses/actors and lots of fun, entertainment, and suspense’re to be revealed.
This award has been continuing since 1943. Group of writers gathered together to frame the Hollywood Foreign Press Association and made liberally distributed award named Golden globe Award where they play momentous role in film making. The first award was being honored on best achievement in 1943 filmmaking and was held in January 1944, at the 20th Century –Fox studios. Successively, every year ceremonies were held in different venues for decades.
Golden Globe 2016 Live Stream||@The 73rd annual Golden Globes Awards Open ceremony Live Stream by The Hollywood
Foreign Press, On January 10, 2016 from Beverly Hilton Hotel.
The Golden Globes first Academy Awards 2016
http://goldenglobeawards2016live.com/
FOR UPCOMING MOVIE: http://moviejon.com/
The Golden Globe Awards Live Stream will take place at the Beverly Hilton Hotel on January 10. But first, the
nominees must be announced! The nominations live stream is expected to begin at 8:15 a.m. Eastern Time. Stay
tuned! Angela Bassett, Chloe Grace Moretz, Dennis Quaid, and America Ferrera will all participate in the event,
revealing the nominees in more than 20 different categories spanning film and television. They’ll be joined by
Corinne Foxx, the daughter of Jamie Foxx, who was recently announced as Miss Golden Globe for the 73rd annual
Golden Globes ceremony. Bassett is a Golden Globes winner, as is Ferrera, while Quaid is a former nominee.
When everyone’s afraid of superintelligent machines taking over the world and no one can run a The Golden Globes
first Academy Awards presentation was held on May 16, 1929, at a private dinner at the Hollywood Roosevelt Hotel
with an audience of about 270 people The post-awards party was held at the Mayfair Hotel The cost of guest
tickets for that night’s ceremony was $5 dollars [$69 as of 2015] Fifteen statuettes. And Now 2016 HFPA: 73rd
Annual Golden Globe Awards – Beverly Hilton with host Ricky Gervais. – Sunday, January 10, 2016 .
I hope everyone like this information they shared as I do. Really great information. contoh dan cara membuat surat lamaran kerja melalui email
Good and nice information about it.Thanks bro
Voter card status
makar sankranti history
makar sankranti wishes in kannada
makar sankranti picture
makar sankranti wallpaper download
Movierulz
Malayalam Movies Online
Bollywood Movies Online
Telugu Movie Online
Hollywood Movies Online
Tamil Movies
Keep Sharing and Rocking
Money lender
Licensed Money lender Singapore
Good to know that ,Thanks
Wedding Photographer singapore
your welcomeimo for pc
imo download thanks
happy valentines day
Generally I don’t read article on blogs, but I would like to say that this write-up very compelled me to take
a look at and do so! Your writing style has been amazed me.
Thank you, very great post.
Please visit our wonderful and valuable website-whatsapp for java
Thanks for the info seems a very serious issue well the deveopers needs more focus on security
http://flipmydeal.in/
Loved you blog, appreciable.
Samsung Galaxy Note 6
Galaxy Note 6
Loved you blog, appreciable.
Samsung Galaxy Note 6
Galaxy Note 6
Ios always has some issues. better to use android...
shayari in marathi
Very important blog in developers point of view. it was worth reading it.
26 january whatsapp status
Thanks for share,
Happy Valentines Day Images
Best Whatsapp Status in Hindi
Check out some great games and ios apps for Apple iPhone
http://www.samteck.net
thx for an innovative article, airdroidforpc
interesting and very interesting facts to read and to gain knowledge factsd.com. thanks for sharing it.
Generally I don’t read article on blogs, but I would like to say that this write-up very compelled me to take
a look at and do so! Your writing style has been amazed me.
Thank you, very great post.
Please visit our wonderful and valuable website-
idm cc
Very useful post i really appreciate thanks for sharing such a nice post. I wanna thanks to a great extent for providing such informative and qualitative material therefore often.
cara mengatasi sperma ( air mani ) encer pada pria secara alami
Thanks for sharing this beautiful piece of content on the internet, i'm highly obliged and it's my privilege sharing this article online.
http://www.ahlinyaobatherbal.com/cara-mengatasi-sperma-air-mani-encer-pa...
Thanks for such nice things .I love great fire
Wedding Photographer
Raygan Photography Singapore
Nice Status in Hindi
Click Here
Great post......
valentines day 2016 ideas
valentines day sms 2016
valentines day 2016 wishes
happy valentines day quotes
happy valentines day greetings
happy valentines day message
happy valentines day images
页面
添加新评论