VPN Articles and News

Apple Devices Vulnerable To Masque Attacks

Tuesday, January 20th, 2015

Security experts have warned that Apple’s mobile devices are vulnerable to a new type of attack that allows hackers to steal sensitive data and even take control of the devices remotely. The vulnerability was discovered by the security firm FireEye in July and has been named as “Masque” attack due to its ability to masquerade as a real and trusted app. FireEye published a detailed post about the vulnerability on its blog where it also revealed that the attack is made possible due to the existence of a software bug in iOS 7 & 8, the operating system that powers Apple’s mobile devices such as iPhones and iPads.

Apple’s products are often praised for their security. Due to the large number of security features built within the company’s devices and apps, it is not easy for hackers to infect an Apple device the way they can infect Windows and Android devices. One of the most effective methods used by Apple to ensure the integrity of its mobile ecosystem is that it checks all the apps for security loopholes before making them available through the iTunes stores. However, the same level of stringent checks are not conducted for custom built apps that are used by the employees of large corporations.

While the iTunes store includes applications for every kind of functionality imaginable, enterprises often have special needs that cannot be fulfilled by the existing apps. In addition, large corporations often need apps to comply with their own set of security policies. For such customers, Apple has developed a system which allows them to build and use custom software without having to go through the approval process that is needed for the apps sold through the App store. The Masque attack takes advantage of this loophole to infect devices and steal data from the users.

Since the custom built apps are not vetted by Apple, hackers are able to bypass the usual security checks through a Masque attack and spread links to dangerous programs through emails, text messages or website links. Once a malicious app is installed on a device, it can replace trusted apps that were installed by the user through the App store. The app can then be used to steal sensitive data (such as email and banking credentials) and even control the infected device from another location.

Firefly termed the vulnerability as extremely powerful and easily exploitable. The company also added that Apple has not patched the bug so far even though it was made aware of its presence in July. What’s worse, the vulnerability has already been used in the high profile WireLurker attack so more attacks of similar nature cannot be ruled out in the near future. As of now, the only way to protect yourself from the vulnerability is not to install third party apps on your device. In addition, Apple has also advised its users not to click on the ‘Install’ button that pops up on third party web pages as well as uninstall apps that have been published by ‘Untrusted App Developers’ (rating available through iOS).

January 20, 2015

Leave a Reply

Your email address will not be published. Required fields are marked *

6 + 3 =