Researchers outwit Apple, plant malware in the App Store
'Jekyll' app assembles hidden attack code only after Apple's screened the software
Computerworld - A team of researchers from Georgia Tech has demonstrated how hackers can slip a malicious app by Apple's reviewers so that it's published to the App Store and ready for unsuspecting victims to download.
Led by Tielei Wang, a research scientist at Georgia Tech's school of computer science, the team created a "Jekyll" app -- named for the Robert Louis Stevenson novella, Strange Case of Dr. Jekyll and Mr. Hyde -- that posed as a benign news reader. Hidden inside the app, however, were code fragments, dubbed "gadgets," that self-assembled to create a proof-of-concept exploit only after the app was approved by Apple.
The assembled attack code was able to send tweets, email and texts without the user's knowledge, and could steal the iPhone's unique device ID, turn on the camera and take video, forward voice calls to other phones and connect with local Bluetooth devices. Because the reconfigured app also "phoned home" to a server operated by the researchers, they were able to download additional malware and compromise other apps on the smartphone, including the Safari browser.
What had seemed on the surface -- far below the surface for that matter -- to be a harmless Dr. Jekyll was silently transformed into an evil Mr. Hyde.
Those code gadgets -- and the app's true control flow and operation -- were disguised in such a way that it would be virtually impossible for Apple's current review methods to discover the app's real intent. "Even with a longer time [to analyze the app] they can't find that it's malicious," said Wang in an interview Monday.
Vulnerabilities, which the Jekyll app secretly planted in its code, are also nearly impossible to detect or stamp out, he said.
In fact, Wang and his team -- Kangjie Lu, Long Lu, Simon Chung, and Wenke Lee, all of Georgia Tech -- sidestepped every major security technique baked into iOS, including sandboxing and code signing, as well as anti-exploit technologies like DEP (data execution prevention) and ASLR (address space layout randomization).
"For instance, the app can deliberately leak its memory layout information to the remote server so that ASLR is completely ineffective," the group wrote in the paper (download PDF) they presented Friday in Washington, D.C. at the USENIX Security Symposium. "Based on the memory layout information, attackers can launch attacks by reusing the [existing] code inside the app. As a result, DEP and code signing cannot prevent the exploit."
The Georgia Tech researchers built their Jekyll app and submitted it to Apple, which approved it seven days later. Once on the App Store, the team downloaded the app onto their own iPhones, told it to transform into a Mr. Hyde and ask for instructions from their server. After confirming that it worked as designed, they removed the app from the App Store.
No other users downloaded the app while it was available, Wang said.
Unlike Android, Apple's iOS has been remarkably free of malicious apps, due to the Cupertino, Calif. company's mandate that only apps from its App Store can be installed on an unmodified iPhone. Apple also conducts a review before approving an app, purportedly looking for malicious code or unsanctioned operations. It rejects those it believes are suspicious or that sport illegal functions.
- Apple to fix iOS 7 crash bug
- Apple rang up $10B in app sales in 2013
- Balky browsers tick off tablet owners
- iPhone, iPad dwarf mobile rivals in small- and mid-sized firms
- iOS 7 now powers 3 out of 4 Apple devices
- How to fix iOS 7 glitches
- After a week, iOS 7 runs more than half of Apple's mobile devices
- First look: The new iPhone 5S impresses
- iOS 7 off to speedy adoption start
- Amazon redesigns Kindle app for iOS 7, adds Collections
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
- HP HAVEn: See the big picture in Big Data HP HAVEn is the industry's first comprehensive, scalable, open, and secure platform for Big Data. Enterprises are drowning in a sea of data...
- What Datapipe customers need to know about the new PCI DSS 3.0 compliance standard This handy quick reference outlines what PCI DSS 3.0 is, who needs to be compliant and how Alert Logic solutions address the new...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Malware and Vulnerabilities White Papers | Webcasts