Posted by: devnullius
« on: 16. February 2015., 11:30:43 »Nowhere to hide...
Members
Total Members: 14197- Latest: Levine
Stats
- Total Posts: 43441
- Total Topics: 16533
- Online today: 3192
- Online ever: 51419
- (01. January 2010., 10:27:49)
Users Online
Posted by: Samker
« on: 07. February 2015., 07:48:50 »
Attackers, perhaps of Russian origin are infecting the iPhones linked to government, defence and media sectors with dangerous spy malware capable of breaching non-jailbroken devices, researchers say.
The XAgent malware part of attacks unveiled last year against Windows devices has moved to iOS targeting iOS 7 and to much lesser effect iOS 8: http://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/pawn-storm-espionage-attacks-use-decoys-deliver-sednit
About a quarter of Apple users still run iOS 7.
Trend Micro threat researchers Lambert Sun, Brooks Hong, and Feike Hacquebord said the malware could monitor and siphon media, directories, text messages to remote servers and capture photos and audio on jailbroken devices.
"The XAgent app is fully functional malware," the trio said in a research note: http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/?linkId=12146208
"The exact methods of installing these malware is unknown; however, we do know that the iOS device doesn't have to be jailbroken ... we have seen one instance wherein a lure involving XAgent simply says 'tap here to install the application'."
That attack relied on Cupertino's ad hoc provisioning used by app developers to enable installation with a link.
Attacks against iOS 7 devices quietly restarted when closed and remained invisible to the user as a background process. It fared far worse on iOS 8 where it had to be manually started on reboot by victims and could not hide.
Researchers said the malware appeared to be carefully maintained and consistently updated
XAgent was tied to a campaign dubbed Operation Pawn Storm targeting anti-Russian actors linked to the Ukraine conflict which used typosquatting and phishing to compromise high-profile victims: http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-pawn-storm.pdf
The command and control server used in the attacks was in operation at the time of research.
(ElReg)