Image: Martyn Williams/IDGNS
Attackers are exploiting a weakness in Apple’s digital rights management technology to install malicious apps on supposedly protected, non-jailbroken iOS devices.
In late February, security researchers from Palo Alto Networks found three malicious applications on the official App Store. An analysis revealed the malicious apps were part of a scheme to steal Apple IDs and passwords from Chinese users under the guise of an alternative app store.
The more interesting aspect of the apps: In addition to being published on the official app store, they were also silently installed through software running on users’ Windows PCs.
An iOS device that hasn’t been jailbroken, and hasn’t had its security restrictions removed, should only be able to run apps downloaded from the App Store or installed through the iTunes software from users’ PCs.
When pushing an app through iTunes to an iOS device connected to a computer, the device performs a check to ensure that the app was indeed acquired from the App Store. This is part of Apple’s FairPlay DRM technology.
However, in 2014, a team of researchers from Georgia Institute of Technology presented a method through which an iOS device could be tricked to allow the installation of an app through iTunes that was previously acquired by a different Apple ID.
“Attackers can remotely instruct an already compromised computer to install apps on a connected iOS device, completely bypassing DRM checks,” the team of researchers warned at the time. “Even if an app has been removed from the App Store, attackers can still distribute their own copies to iOS users.”
According to Palo Alto Networks, this bypass technique still works and was used to install the newly found malicious apps, which the company has dubbed AceDeceiver, on non-jailbroken devices.
More specifically, the attackers first uploaded their apps to the App Store, managing to pass Apple’s review process by presenting them as wallpapers. They then purchased those same apps through iTunes and captured the FairPlay authorization code.
The attackers then created a piece of software that simulates iTunes and distributed it in China as a helper program for iOS devices that can perform system reinstallation, jailbreaking, system backup, device management, and system cleaning.
When users connected their devices to a computer with this software installed, it silently installed AceDeceiver on those devices by using the previously captured authorization code. The only indication of the attack was the app icon appearing on the device home screen after the installation was done.
This means that even if the AceDeceiver apps have been removed from the App Store, the attackers can continue to spread them using the PC software because they already have the authorization code they need.
In this case, the attackers tricked users into installing the iTune-like software themselves, but in future attacks, they could do it through malware that silently infects computers through exploits.
“Our analysis of AceDeceiver leads us to believe FairPlay MITM [man-in-the-middle] attack will become another popular attack vector for non-jailbroken iOS devices — and thus a threat to Apple device users worldwide,” the Palo Alto researchers said in a blog post Wednesday.
This is the second time in a month when researchers found rogue apps on the App Store, proving that bypassing Apple’s app review process is not only possible, but fairly easy. In both cases, the malicious apps masqueraded as harmless applications and only enabled their malicious functionality when run on devices with IP addresses from China.
