Apple Instructs Developers to Validate Their Xcode Install Following XcodeGhost Malware Attack

Apple has posted a message to developers to address the recent XcodeGhost malware attack. The attack resulted from a compromised version of Xcode that was used by developers to submit apps to the App Store.

Here's what Apple said...

---
We recently removed apps from the App Store that were built with a counterfeit version of Xcode which had the potential to cause harm to customers. You should always download Xcode directly from the Mac App Store, or from the Apple Developer website, and leave Gatekeeper enabled on all your systems to protect against tampered software.


When you download Xcode from the Mac App Store, OS X automatically checks the code signature for Xcode and validates that it is code signed by Apple. When you download Xcode from the Apple Developer website, the code signature is also automatically checked and validated by default as long as you have not disabled Gatekeeper.

Whether you downloaded Xcode from Apple or received Xcode from another source, such as a USB or Thunderbolt disk, or over a local network, you can easily verify the integrity of your copy of Xcode.
---

The company also provided instructions on how to validate your Xcode install.

More details at the link below...


Read More