• Home
  • Apps
  • iOS
  • News
  • Researchers Sneak Malicious ‘Jekyll and Hyde’ App Into the iOS App Store

Researchers Sneak Malicious ‘Jekyll and Hyde’ App Into the iOS App Store

Researchers Sneak Malicious ‘Jekyll and Hyde’ App Into the iOS App Store

Researchers at the Georgia Institute of Technology were able to get a malicious app approved by Apple and into the App Store via a “Jekyll & Hyde” approach, where a benign app was remotely changed into a malicious app after it had been approved and installed.

dr-jekyll-and-mr-hyde

9to5Mac:

It appeared to be a harmless app that Apple reviewers accepted into the iOS app store. They were later able to update the app to carry out a variety of malicious actions without triggering any security alarms. The app, which the researchers titled “Jekyll,” worked by taking the binary code that had already been digitally signed by Apple and rearranging it in a way that gave it new and malicious behaviors …

The researchers presented their findings in a paper at the USENIX Security Forum.

Our method allows attackers to reliably hide malicious behavior that would otherwise get their app rejected by the Apple review process. Once the app passes the review and is installed on an end user’s device, it can be instructed to carry out the intended attacks. The key idea is to make the apps remotely exploitable and subsequently introduce malicious control flows by rearranging signed code. Since the new control flows do not exist during the app review process, such apps, namely Jekyll apps, can stay undetected when reviewed and easily obtain Apple’s approval.

An Apple spokesman says that changes have been made to iOS as a result of the researchers exploit, but did not specify if the changes were made to the current iOS 6, or Apple’s upcoming iOS 7 operating system.

The researchers say they left their app on the App Store for only a few minutes, and that it was not downloaded by anyone outside of the project.

Related

  1. iOS Apps Pirating Service Hackulous Shuts Down, Citing ‘Stagnant’ Community Support
  2. ResearchKit App Receives Thousands of Sign-Ups in Hours Following Launch
  3. Explore Your Music Universe With Planetary for iPad
  4. Apple Now Offers (PRODUCT)RED Leather iPhone 6s and 6s Plus Cases
  5. Survey: E-book Reading Up, Print Reading Down
  6. Starbucks Partners With Square for Payment Processing
Apple Giveaways

iPhone X Giveaway

$999

Enter

MacBook Pro Giveaway

$1499.00

Enter

10.5″ iPad Pro Giveaway

$649.00

Enter

iPhone 8 Plus Giveaway

$800.00

Enter
Share