Apple has acted quickly to address a malware threat to iOS and Mac OSX computers, saying Thursday it has blocked apps from running that are infected with the WireLurker malicious code.
A day earlier, security vendor Palo Alto Networks revealed a campaign in which hackers were transferring malware to Apple devices through infected desktop applications downloaded from a Chinese marketplace.
The attack was a novel one in that it compromised iOS devices that had not been jailbroken, or altered to remove the restrictions that prevent people from downloading apps outside of the thoroughly-vetted App store.
About 467 Mac desktop applications were found to be infected with WireLurker at an app store for Chinese users called Maiyadi. The malware waits until an iOS device is connected to the desktop via USB, then uses one of a two methods to infect the mobile device. WireLurker can then steal data from the device, such as phone logs.
Apple didn’t say exactly what steps it has taken to stop the attack, but said “we are aware of malicious software available from a download site aimed at users in China, and weve blocked the identified apps to prevent them from launching.”
The company reiterated its longstanding advice to download software only from trusted sources.
Apple says the best way to avoid malware on an iOS device is to only load apps from the official App Store.
Dave Jevans, founder and CTO for mobile security company Marble Security, said Apple had a few different options for thwarting WireLurker.
One way it infects devices is by using an enterprise provisioning certificate, which is used by developers building apps for in-house that don’t appear on the App Store. The certificates are what allows those apps to run on iOS, and in the hands of a malicious hacker could be used to spread infected applications. Apple revoked the certificate used by WireLurker’s creators, Jevans said.
That would help protect phones that aren’t jailbroken from running infected apps, but it might not help those whose devices have already been infected, he said.
Apple could also update Safari to prevent people from navigating to the Maiyadi website, but users would still be able to get there using Chrome or other browsers. The company could also update its XProtect antivirus engine with a signature to block WireLurker installations, Jevans said.