Masque Attack Hacking iPhones

Word is out: the new trend has just become hacking iPhones for fun and self-gain. Hooray to that.

Oh, yes, this is happening. If you thought you were safe from all of the phone hacking hysteria going around nowadays, you are very, VERY wrong. Because from now on, Android phone owners won’t be the only ones fearing the evil cybergeeks (referred to as EC from now on.) iPhones are the new targets and since most of us spend lots of time playing on mobile casinos, for instance, it is important to know what the threat actually is. So, how do they go about destroying our phones – and potentially our lives? Let’s take a look.

According to Business Insider, the system works the following way: we surf on the Internet, find an app we would like to try. We quickly download it in the hopes of being able to use it as soon as possible. We don’t even notice (can’t even notice,) that the downloaded application is in fact a disguise. It seems to be working normally, the functionalities all check out, but in truth, hackers are controlling it. As the Business Insider reports, “The installations occur when users unwittingly click on web links that trigger the downloads.” The worst part of these EC-made apps is that we really are unable to notice that something is wrong with the given app.

Many well-known apps have fallen victim to ECs hacking iPhones

Oh, and it gets even worse. We’re not only talking about apps made by small, unknown companies, either. As FireEye says, the affected applications (that they know of) include WhatsApp, Twitter, Facebook, Facebook Messenger, WeChat, Google Chrome, Viber, Blackberry Messenger, Skype, Telegram, and VK. So far, there is no information available on whether mobile betting sites are affected or not. According to FireEye, “Unlike the normal versions of these apps, they (the malware) come with an extra binary designed to exfiltrate sensitive data and communicate with a remote server. Because all the bundle identifiers are the same as the genuine apps on App Store, they can directly replace the genuine apps on iOS devices prior 8.1.3.”

What happens once these EC-created apps land on our iPhones? Well, as Simon Mullis, the technical leader of FireEye global says, “Once installed, the new malicious application can hijack the communications used by legitimate apps and steal information, such as login credentials.” Which means that hackers will be able to access nearly every personal detail until the last one. Just think about it. Most people use one password for all or at least most of their online dealings. So, if ECs get a hold of your password for Facebook, they presumably will be able to log into your e-mail and Twitter account, too. Even your account that you set up on your favourite gambling site is unsafe.

The App Store is considered a safe haven

If you are worried that you might be the target of such an attack, FireEye suggests that you download all of your mobile casino gambling apps from App Store. The Store is, according to FireEye safe for downloads. Furthermore, malicious apps can only be downloaded if you actually click on an infected web link. So, exercise caution when searching for a new internet casino. The Business Insider added: “the technique works on all major mobile operating systems including iOS and Android. But so far, FireEye has only seen the attack used against iPhone users.” How did ECs find out about this weakness? Well, some information from the web security company Hacking Team was stolen. Simple as that.

Unfortunately, these apps are out there and working, or as Simon Mullis told the Business Insider: We have found examples of many well-known apps have been repackaged in this way: Twitter, Facebook, WhatsApp, Viber, Skype and others. They are versions of the standard app with extra functionality to exfiltrate sensitive information to remote servers. We have found these applications in use in the wild.” Right now, the exact number of victims who have fallen into the trap is unknown. FireEye’s Simon Mullis said that there are only a small number of people affected… for the time being, that is.