Attackers exploit Apple DRM weakness to infect non-jailbroken iOS devices

If a malicious app is published on the App Store once and then is removed, attackers can continue to infect devices with it through PC malware

Attackers are exploiting a weakness in Apple's digital rights management technology to install malicious apps on supposedly protected, non-jailbroken iOS devices.

In late February, security researchers from Palo Alto Networks found three malicious applications on the official App Store. An analysis revealed the malicious apps were part of a scheme to steal Apple IDs and passwords from Chinese users under the guise of an alternative app store.

The more interesting aspect of the apps: In addition to being published on the official app store, they were also silently installed through software running on users' Windows PCs.

An iOS device that hasn't been jailbroken, and hasn't had its security restrictions removed, should only be able to run apps downloaded from the App Store or installed through the iTunes software from users' PCs.

When pushing an app through iTunes to an iOS device connected to a computer, the device performs a check to ensure that the app was indeed acquired from the App Store. This is part of Apple's FairPlay DRM technology.

However, in 2014, a team of researchers from Georgia Institute of Technology presented a method through which an iOS device could be tricked to allow the installation of an app through iTunes that was previously acquired by a different Apple ID.

"Attackers can remotely instruct an already compromised computer to install apps on a connected iOS device, completely bypassing DRM checks," the team of researchers warned at the time. "Even if an app has been removed from the App Store, attackers can still distribute their own copies to iOS users."

According to Palo Alto Networks, this bypass technique still works and was used to install the newly found malicious apps, which the company has dubbed AceDeceiver, on non-jailbroken devices.

More specifically, the attackers first uploaded their apps to the App Store, managing to pass Apple's review process by presenting them as wallpapers. They then purchased those same apps through iTunes and captured the FairPlay authorization code.

The attackers then created a piece of software that simulates iTunes and distributed it in China as a helper program for iOS devices that can perform system reinstallation, jailbreaking, system backup, device management, and system cleaning.

When users connected their devices to a computer with this software installed, it silently installed AceDeceiver on those devices by using the previously captured authorization code. The only indication of the attack was the app icon appearing on the device home screen after the installation was done.

This means that even if the AceDeceiver apps have been removed from the App Store, the attackers can continue to spread them using the PC software because they already have the authorization code they need.

In this case, the attackers tricked users into installing the iTune-like software themselves, but in future attacks, they could do it through malware that silently infects computers through exploits.

"Our analysis of AceDeceiver leads us to believe FairPlay MITM [man-in-the-middle] attack will become another popular attack vector for non-jailbroken iOS devices -- and thus a threat to Apple device users worldwide," the Palo Alto researchers said in a blog post Wednesday.

This is the second time in a month when researchers found rogue apps on the App Store, proving that bypassing Apple's app review process is not only possible, but fairly easy. In both cases, the malicious apps masqueraded as harmless applications and only enabled their malicious functionality when run on devices with IP addresses from China.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?