Yesterday cybersecurity firm, FireEye, published a blog post in which they detail their ‘Masque Attack’ exploit against iOS. The exploit dupes users into installing what appears to be a valid app update, but in fact replaces the original app and starts stealing user data immediately. FireEye says it first notified Apple Inc. about the threat back in July.

FireEye goes into some detail with an example showing an app update titled “New Flappy Bird”. The step-by-step example shows how the fake app actually replaces the Gmail app on the phone giving the attacker the ability to upload the user’s email to a remote server. The user interface is identical so an unsuspecting user will be none the wiser. (see full demo below)

How it works

According to the blog post, the exploit works on iOS7 and iOS8 devices and takes advantage of the fact that iOS does not enforce matching certificates for apps using the same bundle identifier. These are of course used to sign software updates and verify that they come from a valid source. An app’s bundle identifier is easy to find within the app itself and can be used for the fake app.

The exploit cannot replace native iOS apps like Safari and Mail, but apps installed via the App Store are open to attack. The blog post goes on to state that “Masque Attacks can replace authentic apps, such as banking and email apps, using attacker’s malware through the Internet. That means the attacker can steal user’s banking credentials by replacing an authentic banking app with malware that has identical UI.”

Protect yourself

FireEye suggests that users follow these three steps to protect themselves from Masque Attacks:

1. Don’t install apps from third-party sources other than Apple’s official App Store or the user’s own organization
2. Don’t click “Install” on a pop-up from a third-party web page, as shown in Figure 1(c), no matter what the pop-up says about the app. The pop-up can show attractive app titles crafted by the attacker
3. When opening an app, if iOS shows an alert with “Untrusted App Developer”, as shown in Figure 3, click on “Don’t Trust” and uninstall the app immediately

This is the second attack on iOS users in as many weeks. Just last week Palo Alto Networks reported on WireLurker which attacks iOS devices via USB connection to a Mac.

photo credit: Kiwi-Lomo via photopin cc