Apple Working With Developers to Clean Up Malware Attack
Toggle Dark Mode
Apple’s App Store has been facing its first major malware attack over the past week. Details about the attack, called XcodeGhost, were revealed earlier this week by security firms such as Palo Alto Networks and Qihoo 360.
The attack, which originated in China, affected nearly 350 apps, including WeChat, a messaging app similar to WhatsApp, popular in China. The attack originated when hackers distributed a faulty version of Xcode, Apple’s official tool for developing apps, to developers. These developers then unknowingly created apps with malware that collected phone data, banking data, and more for malicious hackers.
Early this week, Apple cleaned the app store of known-infected apps. Apple spokeswoman Christine Monaghan told the New York Times on Sunday that Apple has “removed the apps from the App Store that we know have been created with the counterfeit software.”
WeChat, a Popular Messaging App, Was One of the Largest Apps Affected
To ensure that such an attack does not re-occur, Apple today released a statement to developers urging them to validate their version of Xcode, and to, in the future, only download new versions directly from Apple. An email sent out this morning stating the following:
We recently removed apps from the App Store that were built with a counterfeit version of Xcode which had the potential to cause harm to customers. You should always download Xcode directly from the Mac App Store, or from the Apple Developer website, and leave Gatekeeper enabled on all your systems to protect against tampered software.
When you download Xcode from the Mac App Store, OS X automatically checks the code signature for Xcode and validates that it is code signed by Apple. When you download Xcode from the Apple Developer website, the code signature is also automatically checked and validated by default as long as you have not disabled Gatekeeper.
Whether you downloaded Xcode from Apple or received Xcode from another source, such as a USB or Thunderbolt disk, or over a local network, you can easily verify the integrity of your copy of Xcode.”
Apple has also posted instructions for developers detailing how developers can ensure that the version of Xcode they are using is legit. Although Apple has likely rid the App Store of any offending apps, it’s also important for users to ensure they keep their apps updated to avoid any infected apps.
