iPhone users are usually considered safe from malware, but a new report from Palo Alto Networks suggests that reputation may be about to change. Palo Alto’s researchers have discovered a bug called Wirelurker, which the company says may have already impacted hundreds of thousands of users. The bug is primarily spreading through the Maiyadi App Store, a third-party source for OS X software in China, and researchers estimated the infected apps have been downloaded 356,104 times already. Once the computer is infected, Wirelurker spreads to iOS devices that connect over USB, rewriting existing programs on the device through binary file replacement. It’s the first such bug that can infect iPhones that haven’t been jailbroken, using the rarely examined enterprise provisioning system, intended to allow large companies to deploy software without going through the app store approval process.
New iOS malware spreads through infected desktop software
Everything I've read so far in the WireLurker white paper seems not only completely plausible, but easy to pull off with libimobiledevice.
— Jonathan Zdziarski (@JZdziarski) November 6, 2014 Ironically, once Wirelurker gains access to a non-jailbroken iPhone, the program simply side-loads a non-malicious comic book app onto the phone, using a forged enterprise provisioning certificate. Palo Alto researchers suspect it’s a test payload to ensure the system works before moving on to more profitable ends. For jailbroken phones, the malware rewrites the apps for the TaoBao and AliPay apps (Alibaba’s applications for auctions and payments, respectively) so as to harvest payment information.
But even with its current limitations, the bug represents the first serious compromise of iOS security, and presents security researchers with a number of novel attack vectors that must now be secured. Palo Alto Networks has already developed software that will let users test for the bug, but in the meantime, they recommend users avoid third-party app stores and avoid using USB-based chargers from unknown sources. “This malware is under active development,” the report says, “and its creator’s ultimate goal is not yet clear.”
11/5 9:47pm ET: Updated with more information on the Wirelurker payload
