Apple Removes Over 300 Malicious Apps From Its Official Store

Apple is known for being diligent by performing additional checks on apps that get placed it the app store for malicious code. Unfortunately, someone found a hole, or several, in its process and over 300 malicious apps were allowed in.

So far, it appears that no real damage has occurred as a result and Apple has removed them. However, this just shows that there are no guarantees even when using the official app stores. That said, it still is the better option between it and sideloading (downloading apps from a location other than official app stores).

Companies like Google and Apple do perform additional checks before allowing the apps to be put into the stores. However, Apple is known for being taking extra precautions and until now, has been successful in keeping all but about five malicious ones out of the store. In this case, it appears that someone has figured a way around the additional checks, not necessarily to do damage yet, but perhaps as a proof of concept to make sure they can.

Sideloading is generally only allowed if users “jailbreak” their devices. This means to unlock them so that they have more control over how they are used and what they can do with them. Most people don’t do this because they lose support of the device and cannot update them. And frankly, most people don’t need to unlock them. However, losing that ability to update them is a key factor in why it shouldn’t be done. If a critical or security update is released, it is important to apply it right away.

The affected apps appear to have been created using a compromised copy of the developer’s tool Xcode and was downloaded from a server in China. Why would a developer take the risk of not using the app store for this code? It is thought to be because it was faster to get it from another server. Due to China’s internet filtering mechanisms, software from internationally hosted servers are significantly slower, motivating the Chinese developers to seek faster ones for large files.

The malicious code was injected with the malware Xcode Ghost just before the app made it to the store. The apps in this case are said to be mostly for the Chinese market. But don’t let your guard down. If someone found this in China, it is possible it could be exploited in other countries as well. Make sure to download software, even coding software, from legitimate servers and do research on apps you want to install on your mobile devices before doing so.