New Apple iPhone Malware Exploits DRM Mechanism To Spread

A new family of Apple iOS malware that has begun affecting users in China is another reminder of why it is generally not a good idea to jailbreak your iPhone or to download pirated software from unofficial mobile app stores.

The malware, dubbed AceDeceiver, has grabbed some attention for its ability to infect non-jailbroken iPhones just as easily as it can jailbroken ones.

Security vendor Palo Alto Networks, which reported on the threat this week, describes AceDeceiver as malware that exploits flaws in Apple’s Digital Rights Management (DRM) technology to install itself without any of the security mechanisms that are normally required.

AceDeceiver is the first malware to exploit a technique called “FairPlay Man-In-The-Middle (MITM)” that hackers have typically used to distribute pirated iOS software.

For the moment at least, AceDeceiver poses a threat only to users of a software tool called Aisi Helper. Many people in China have installed the tool on their Windows PCs to manage their iOS devices, says Ryan Olson, director of threat intelligence at Palo Alto Networks’ Unit 42.

Aisi Helper purports to help users carry out tasks like system re-installation, backup, and cleaning for iOS devices. It also serves as a tool for jailbreaking iOS devices and is often used by people who want to install free and likely pirated apps on their phones, Olson says.

According to Palo Alto Networks, as of Dec 2014, some 15 million people had downloaded the tool, and 6.6 million were using it actively.

Once installed on a PC, Aisi Helper surreptitiously downloads and installs AceDeceiver on the system, which in turn connects to a third-party iOS app store controlled by the authors of the software.

AceDeceiver prompts users for their AppleID and passwords, which it then sends to a remote server though it is not clear what exactly the authors of the software are doing or plan to do with it, Olson says.

The manner in which the malware authors have exploited Apple’s DRM mechanism to install AceDeciever on non-jailbroken iPhones is really the big issue, Palo Alto researcher Claud Xiao wrote in the company’s alert on the threat.

First, the authors of the malware managed to upload three versions of AceDeceiver to Apple’s official App Store by evading the company’s code review and filtering mechanisms, on seven separate occasions. Each time the app was disguised as a wallpaper app.

Apple has since removed the apps, but the authors of the malware can still distribute it by taking advantage of an Apple DRM mechanism called FairPlay.

FairPlay lets users purchase and download iOS apps from Apple’s App Store to their Macs or PCs, via iTunes. When a user then wants to upload the app to their iPhone or iPad, the device first checks with the iTunes software for an authorization code to ensure the app has been legally purchased.

Back in 2013, hackers discovered that by intercepting the communication between an iPhone or iPad and a Mac or PC that has downloaded an app from App Store, they could retrieve the authorization code and then use it to install the same app on other devices.

“The authorization codes differ from authorized computer to computer, but between the authorized computer and the phones there is not a check against a User ID,” Olson says. “So if a system has been authorized for an app, the MITM allows that app to be installed on many phones.”

In this case, all that the malware authors had to do was upload AceDeceiver to the App Store and then download it to a Mac or PC to get an authorization code for that computer, which they could then use repeatedly to install the malware on multiple iPhones and iPads.

What makes the technique dangerous is that it doesn’t require apps to have an enterprise certificate and therefore is not under the control of mobile device management tools, Xiao said. The method also doesn’t require users to take any manual action to install the malicious app.

In this case, the attack requires users to have downloaded and install Aisi Helper. The malware is also explicitly designed to work in China. Users from other regions who downloaded AceDeceiver while it was still available in App Store will only see the screensaver.

But there’s no reason why the same approach cannot be tweaked to deliver AceDeceiver and other malware in other regions as well.

“No technical reason exists,” says Guillaume Ross, senior security consultant, at Rapid7 in comments to Dark Reading. “It is possible that the Chinese market is slightly more susceptible to it due to the prevalence of third party application stores [and] more common use of jailbreaking tools,” he says.

Related Content:

Find out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.