XcodeGhost
Sign in to saveXcodeGhost (and variant XcodeGhost S) are modified versions of Apple's Xcode development environment that are considered malware. The software first gained widespread attention in September 2015, when a number of apps originating from China harbored the malicious code. It was thought to be the "first large-scale attack on Apple's App Store", according to the BBC. The problems were first identified by researchers at Alibaba, a leading e-commerce firm in China. Over 4000 apps are infected, according to FireEye, far more than the 25 initially acknowledged by Apple, including apps from authors out
~8 min read
Article
18 sectionsContents
- Discovery
- Operation
- Propagation
- Attack vector
- Origins
- Modified files
- Deployment
- Behavior on infected devices
- Remote control security risks
- Stealing user device information
- Read and write from clipboard
- Hijack opening specific URLs
- Infected apps
- Removal
- Neutralizing command and control servers and compromised versions of Xcode
- Removing malicious apps from the App Store
- Checking Xcode version
- References
XcodeGhost (and variant XcodeGhost S) are modified versions of Apple's Xcode development environment that are considered malware. The software first gained widespread attention in September 2015, when a number of apps originating from China harbored the malicious code. It was thought to be the "first large-scale attack on Apple's App Store", according to the BBC. The problems were first identified by researchers at Alibaba, a leading e-commerce firm in China. Over 4000 apps are infected, according to FireEye, far more than the 25 initially acknowledged by Apple, including apps from authors outside China.
Security firm Palo Alto Networks surmised that because network speeds were slower in China, developers in the country looked for local copies of the Apple Xcode development environment, and encountered altered versions that had been posted on domestic web sites. This opened the door for the malware to be inserted into high profile apps used on iOS devices.