Attackers exploit Apple DRM weakness to infect non-jailbroken iOS devices

If a malicious app is published on the App Store once and then is removed, attackers can continue to infect devices with it through PC malware

Attackers are exploiting a weakness in Apple's digital rights management technology to install malicious apps on supposedly protected, non-jailbroken iOS devices.

In late February, security researchers from Palo Alto Networks found three malicious applications on the official App Store. An analysis revealed the malicious apps were part of a scheme to steal Apple IDs and passwords from Chinese users under the guise of an alternative app store.

The more interesting aspect of the apps: In addition to being published on the official app store, they were also silently installed through software running on users' Windows PCs.

An iOS device that hasn't been jailbroken, and hasn't had its security restrictions removed, should only be able to run apps downloaded from the App Store or installed through the iTunes software from users' PCs.

When pushing an app through iTunes to an iOS device connected to a computer, the device performs a check to ensure that the app was indeed acquired from the App Store. This is part of Apple's FairPlay DRM technology.

However, in 2014, a team of researchers from Georgia Institute of Technology presented a method through which an iOS device could be tricked to allow the installation of an app through iTunes that was previously acquired by a different Apple ID.

"Attackers can remotely instruct an already compromised computer to install apps on a connected iOS device, completely bypassing DRM checks," the team of researchers warned at the time. "Even if an app has been removed from the App Store, attackers can still distribute their own copies to iOS users."

According to Palo Alto Networks, this bypass technique still works and was used to install the newly found malicious apps, which the company has dubbed AceDeceiver, on non-jailbroken devices.

More specifically, the attackers first uploaded their apps to the App Store, managing to pass Apple's review process by presenting them as wallpapers. They then purchased those same apps through iTunes and captured the FairPlay authorization code.

The attackers then created a piece of software that simulates iTunes and distributed it in China as a helper program for iOS devices that can perform system reinstallation, jailbreaking, system backup, device management, and system cleaning.

When users connected their devices to a computer with this software installed, it silently installed AceDeceiver on those devices by using the previously captured authorization code. The only indication of the attack was the app icon appearing on the device home screen after the installation was done.

This means that even if the AceDeceiver apps have been removed from the App Store, the attackers can continue to spread them using the PC software because they already have the authorization code they need.

In this case, the attackers tricked users into installing the iTune-like software themselves, but in future attacks, they could do it through malware that silently infects computers through exploits.

"Our analysis of AceDeceiver leads us to believe FairPlay MITM [man-in-the-middle] attack will become another popular attack vector for non-jailbroken iOS devices -- and thus a threat to Apple device users worldwide," the Palo Alto researchers said in a blog post Wednesday.

This is the second time in a month when researchers found rogue apps on the App Store, proving that bypassing Apple's app review process is not only possible, but fairly easy. In both cases, the malicious apps masqueraded as harmless applications and only enabled their malicious functionality when run on devices with IP addresses from China.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?