The impenetrable fortress is no longer. Cybersecurity firm FireEye has found evidence hackers have figured out how to get malicious apps onto Apple devices.
FireEye found out about this security threat through attack tools leaked during the July 2015 data breach against the computer systems of the Hacking Team, an Italian company that provides technology to law enforcement and intelligence communities worldwide.
Called “masque attacks,” hackers use legitimate-looking but malicious apps that mimic popular applications and persuade users to download them from a link outside the App Store. Those malicious apps can replace legitimate apps already on the device, meaning users may never know they were hacked.
According to FireEye, there are 11 bad iOS apps in the Hacking Team’s arsenal that mimic real apps and are “reverse engineered and weaponized versions of popular social networking and messaging apps.” They include: WhatsApp, Twitter, Facebook, Facebook Messenger, WeChat, Google Chrome, Viber, Blackberry Messenger, Skype, Telegram and VK.
Once downloaded and installed on an Apple device, those apps can send sensitive personal data to a remote service, including photos, contacts, voice recordings, browser history, phone calls, text messages and even precise GPS coordinates.
This is the first instance of targeted iOS malware being used against non-jailbroke iOS devices, notes FireEye.
Should you be worried?
The Hacking Team sells their services to governments and spy agencies, and this kind of attack would be ideal for keeping tabs on the people they want to monitor.
While you probably don’t fall under that category, if you own an Apple device — and have any of those apps — you should still be cautious.
What should you do?
FireEye recommends that you keep all of your iOS devices updated to the latest version of iOS.
The firm also says you should follow these steps:
- Install apps only through the App Store “or the user’s own organization.” Avoid third-party sources. This can’t be said strongly enough: You won’t encounter these malicious apps if you download only through Apple.
- If you open an app and get an iOS alert that reads “Untrusted App Developer,” click on “Don’t Trust” and uninstall the app.
It doesn’t hurt to take some extra precautions as well.
Closely monitor your credit reports for any suspicious activity. If you find anything out of the ordinary, contact your issuer immediately.
You can pull your credit reports for free at myBankrate.
Follow me on Twitter: @MitchStrohm