Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Novel Malware Xcode Ghost Modifies Xcode, Infects Apple iOS Apps and Hits App Store

Summary: XcodeGhost is described as the first compiler malware for OS X, with malicious code placed in a Mach-O object file repackaged into Xcode installers and uploaded to Baidu's cloud file sharing service for Chinese iOS and OS X developers. The malware exploits Xcode's default framework search paths to inject code into apps compiled with the infected tool, and at least two iOS apps carrying it passed Apple's code review and were published on the App Store, including NetEase Cloud Music version 2.8.3 built with Xcode 6.4.

Why it matters: Two apps built with a Trojanized compiler cleared Apple's code review and shipped to users, and the same technique could hit enterprise apps distributed in-house that never face App Store review at all.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related