-

Malicious iOS Apps: Apple Urges Developers to Validate Their Xcode Installation

Less than a week after Apple confirmed that about 40 apps in the iOS App Store are affected with malicious code, or malware, the Cupertino-giant is urging developers to validate their copy of Xcode, its suite of developer tools that is used to develop apps for iOS and OS X.
The company has sent a reminder to developers via email and a message posted on its website noting that they should only use Xcode downloaded from the Mac App Store or the company's official developer website.
The email comes days after several Chinese app developers including some associated with big brands such as WeChat, Didi Kuaidi, and CamCard, among others, were caught intentionally bypassing warnings from Apple's "Gatekeeper" software while installing a counterfeit version of Xcode. These developers, it is worth pointing out, didn't deliberately do this to make their products less secure, but instead, they did it because China's Great Firewall makes it slower to access and download files hosted on US servers. This is the reason many used Baidu, a file-sharing website - where a version of Xcode was hosted - to download a copy of the app developing program. As it turned out, the version of Xcode hosted on Baidu was compromised.
"We recently removed apps from the App Store that were built with a counterfeit version of Xcode which had the potential to cause harm to customers. You should always download Xcode directly from the Mac App Store, or from the Apple Developer website, and leave Gatekeeper enabled on all your systems to protect against tampered software," the company notedon its developer website.
(Also see: Apple Hack Exposes Flaws in Building Apps Behind 'Great Firewall')
Gatekeeper ships with OS X and with its default settings, it is designed to allow only those apps to run whose authenticity can be verified. Users have the option to disable Gatekeeper to let it run apps from any source, which is what developers would've needed to do to run the compromised version of Xcode. If the copy of Xcode they had downloaded from any other source was genuine, they wouldn't have needed to disable Gatekeeper at all.
"When you download Xcode from the Mac App Store, OS X automatically checks the code signature for Xcode and validates that it is code signed by Apple. When you download Xcode from the Apple Developer website, the code signature is also automatically checked and validated by default as long as you have not disabled Gatekeeper. Whether you downloaded Xcode from Apple or received Xcode from another source, such as a USB or Thunderbolt disk, or over a local network, you can easily verify the integrity of your copy of Xcode."
Of course, many third-party utilities on OS X continue to be unsigned, so it's possible that developers had disabled Gatekeeper to run those apps, and thus compromised copy of Xcode slipped under the radar.
For users who're affected, it is suggested that they change the password of their Apple ID. One should also not engage with a push dialog box asking for personal information. As noted by security firm before, it has been found that "XcodeGhost" may have been able to push dialog boxes to users' devices asking for personal information. Apple's VP of Marketing Phil Schiller, meanwhile, has assured that Apple doesn't know of any cases where these malicious apps transmitted user information, which is always comforting to know. The company has set up a page on its website to let users know about this hack, and offer answers to many of the questions they might have. Apple also plans to alert users who have downloaded the affected apps.

Comments

Post a Comment

Popular posts from this blog

Best April Fools' Day 2017 Pranks in the Tech World

-
Image
It's April 1, and everyone knows it's April Fools' Day when no one's going to believe in whatsoever you may scream. But when it comes to some reputed and trusted tech companies, they easily get into people's minds with their 'new and latest offerings'. These, in most cases, would be hoax or joke offerings - those that will never exist, or those that will be available for a very short time just for laughs. Even before April 1, these companies start pushing their stories to goof around with you - with little teasers, such as the Dash Charge  announcement  that OnePlus had teased, before making briefly  available  the Dash Energy drink in select outlets Here are 2017's April Fools' tech pranks - the gimmicks, goofs, and pranks that companies decided to plan on us. Some are funny, some inane, and some lame. 1. Google Google  has always been on the frontier of people, with quirky innovations that usually get people believe it. It has some bizarre-...
Read more

Artesian Joins Hands with Microsoft and Innervate

-
Image
Artesian Solutions, an artificial intelligence-driven relationship intelligence service, has announced a new strategic channel partnership with Microsoft and Innervate Technology Solutions that will help financial service organizations boost their investment in Microsoft Dynamics 365. The Artesian-Microsoft Dynamics 365 integration allows businesses to boost their CRM investment by enhancing mission-critical data with real-time news, people insights, and social media. The integration provides deep and actionable insights to customer-facing teams, thus allowing them to better understand their customers’ needs. And this, in turn, makes certain that they never miss the chance perhaps to strike a conversation or get a high ground in reference to their most big-ticket patrons. Andrew Yates, CEO, Artesian, said , “This partnership between Artesian, Microsoft and Innervate is a fantastic example of leading vendors in B2B software transformation coming together to bring ...
Read more
-
Experience the Front Row in In Current VR technology most commonly uses virtual reality headsets or multi-projected environments, sometimes in combination with physical environments or props, to generate realistic images, sounds and other sensations that simulate a user's physical presence in a virtual or imaginary environment. A person using virtual reality equipment is able to "look around" the artificial world, move around in it, and interact with virtual features or items. The effect is commonly created by VR headsets consisting of a head-mounted display with a small screen in front of the eyes, but can also be created through specially designed rooms with multiple large screens. The Virtual Reality Modelling Language (VRML), first introduced in 1994, was intended for the development of "virtual worlds" without dependency on headsets. The Web3D consortium was subsequently founded in 1997 for the development of industry standards for we...
Read more