Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Ace Deceiver: First iOS Trojan Exploiting Apple DRM Design Flaws to Infect Any iOS Device

Summary: Palo Alto Networks' Unit 42 discovered a family of iOS malware called AceDeceiver that installs on non-jailbroken devices by exploiting design flaws in Apple's FairPlay DRM through a technique it calls FairPlay Man-In-The-Middle, rather than abusing enterprise certificates. Three AceDeceiver apps posing as wallpaper apps reached the official App Store between July 2015 and February 2016, bypassing Apple's code review at least seven times, and were removed after Palo Alto Networks reported them in late February 2016.

Key Takeaway: The attack remains viable after removal because FairPlay MITM only requires the apps to have been in the App Store once, and the Windows client Aisi Helper - which had over 15 million users and 6.6 million monthly active users as of December 2014 - silently installs the malware on any connected iOS device.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related