U.S. Government Issues Warning on iOS 'Masque Attack'

U.S. Government Issues Warning on iOS 'Masque Attack'

Posted by · 14276 views · Translate

The United States Computer Emergency Readiness Team, part of the U.S. Department of Homeland Security, has issued a formal alert on the Apple iOS 'Masque Attack'.

A few days ago we reported that FireEye mobile security researchers discovered an iOS security flaw that lets attackers replace your real apps with malware. FireEye found that when installing an app using enterprise/ad-hock provisioning, it could replace a genuine app if it had the same bundle identifier.

Here's the official alert number TA13-317A:

Systems Affected
iOS devices running iOS 7.1.1, 7.1.2, 8.0, 8.1, and 8.1.1 beta.

A technique labeled “Masque Attack” allows an attacker to substitute malware for a legitimate iOS app under a limited set of circumstances.

Masque Attack was discovered and described by FireEye mobile security researchers.[1] (link is external) This attack works by luring users to install an app from a source other than the iOS App Store or their organizations’ provisioning system. In order for the attack to succeed, a user must install an untrusted app, such as one delivered through a phishing link.

This technique takes advantage of a security weakness that allows an untrusted app—with the same “bundle identifier” as that of a legitimate app—to replace the legitimate app on an affected device, while keeping all of the user’s data. This vulnerability exists because iOS does not enforce matching certificates for apps with the same bundle identifier. Apple’s own iOS platform apps, such as Mobile Safari, are not vulnerable.

An app installed on an iOS device using this technique may:
● Mimic the original app’s login interface to steal the victim’s login credentials.
● Access sensitive data from local data caches.
● Perform background monitoring of the user’s device.
● Gain root privileges to the iOS device.
● Be indistinguishable from a genuine app.

iOS users can protect themselves from Masque Attacks by following three steps:
● Don’t install apps from sources other than Apple’s official App Store or your own organization.
● Don’t click “Install” from a third-party pop-up when viewing a web page.
● When opening an app, if iOS shows an “Untrusted App Developer” alert, click on “Don’t Trust” and uninstall the app immediately.

Further details on Masque Attack and mitigation guidance can be found on FireEye’s blog [1] (link is external). US-CERT does not endorse or support any particular product or vendor.

Check out more details on Masque Attack and a video demo at the link below...

Read More [via Reuters]

U.S. Government Issues Warning on iOS 'Masque Attack'

Rajesh kumar - November 23, 2014 at 3:55pm
Latest news on apple products....How to tutorials , how to videos, how to jailbreak, how to install tweaks, how to get cracked apps and much more, please visit www.iphoneclinic.net
iGayCook - November 14, 2014 at 5:47pm
This affects all versions of iOS starting from the crap gay tim cook started which was iOS 7.x.x till the latest 8.x.x jailbroken or not..... iOS 6.x.x below which was made by grand daddy of Apple perfection and not gay Steve Jobs, Rip to him and his wonderful works....
sHomoDung - November 14, 2014 at 8:57pm
This rant of yours started from all the success iphone got, besides nothing is secure than it anyway so what's your whiny @ss excuse first off. Second what the hell makes work gay? What are you even trying to prove with gibberish crap! Rip trolls and their blindly vain attempts.
Alex - November 14, 2014 at 2:32am
Great -_-
iProService - November 13, 2014 at 11:06pm
Is there a jailbreak tweak that fixes this yet? Ryan Petrich (@rpetrich) is usually on the ball in creating patches for these security issues.
9 More Comments