The apps were infected with malware by a fake version of Xcode dubbed XcodeGhost which legitimate developers were fooled into downloading, believing it to be a copy of the genuine Apple app. A partial list of infected apps has been posted by security company Palo Alto Networks …
It was revealed in documents leaked by Snowden earlier this year that using a forged version of Xcode to inject malware into apps is a route the CIA considered using. It was unclear at that time how the agency could get developers to use the compromised app.
While Apple said on Sunday that it was aware of the issue and was removing infected apps, SourceDNA claims that its scans reveal that compromised versions of more than a thousand apps remain live in the Chinese version of Apple’s App Store, and told us that some of them have been infected since April.
Meantime, Wired revealed that security industry firm Zerodium – whose founder Chaouki Bekrar sells spyware to government agencies and corporations around the world – is offering a $1M bounty to anyone who can provide an exploit for breaking into an iPhone or iPad running iOS 9. The requirements for this bounty are quite high, relying on finding a very rare device exploit that can be activated through a website or text message, and if one is found it’s unlikely that it will be announced publicly.
The terms of the offer include the demand that the bug not be reported to Apple or publicly disclosed, the better to allow Zerodium’s customers to use the technique in secret. Apple didn’t immediately respond to a request for comment.
