{"id":4254,"date":"2014-11-06T14:20:50","date_gmt":"2014-11-06T19:20:50","guid":{"rendered":"http:\/\/me-en.kaspersky.com\/blog\/?p=4254"},"modified":"2017-05-19T03:13:01","modified_gmt":"2017-05-19T07:13:01","slug":"wirelurker-ios-osx-malware","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/wirelurker-ios-osx-malware\/4254\/","title":{"rendered":"WireLurker Apple Malware Targets Mac OS X Then iOS"},"content":{"rendered":"<p>A new family of malware emerged yesterday called WireLurker, and it\u2019s capable of infecting devices running both Apple\u2019s mobile iOS platform as well as its desktop Mac OS X operating system.\u00a0Palo Alto Networks, the security company that uncovered the threat, believes that WireLurker could usher in a new era of increased Apple malware.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2014\/11\/05102758\/smashedapple1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6568\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2014\/11\/05102758\/smashedapple1.png\" alt=\"smashedapple\" width=\"800\" height=\"600\"><\/a><\/p>\n<p>For years experts have warned of a coming onslaught of malicious wares targeting Apple systems. In equally hyperbolic fashion, the Cupertino, California computer companies\u2019 more fervent fans have claimed their machines are immune to malware. The reality, as is so often the case, rests somewhere in the middle: Apple malware exists without a doubt but it is not as widespread as Windows and Android malware.<\/p>\n<p>\u201cWireLurker was used to trojanize 467 OS X applications in the Maiyadi App Store, a third-party Mac application store in China,\u201d Palo Alto Networks\u2019 researcher Claud Xiao said. \u201cIn the past six months, these 467 infected applications were downloaded over 356,104 times and may have impacted hundreds of thousands of users.\u201d<\/p>\n<div class=\"pullquote\">Kaspersky Lab products detect and block this threat as Trojan Downloader.OSX.WireLurker.a, so you should be protected.<\/div>\n<p>To be clear: this threat has only infected users in one popular, Chinese application marketplace, but that doesn\u2019t mean it can\u2019t spread elsewhere.<\/p>\n<p>Interestingly though, WireLurker, unlike most prior iOS threats, can infect non-jailbroken devices. This reality is among the five or so reasons that Palo Alto Networks believes that WireLurker may be a watershed moment for Apple malware.<\/p>\n<p>The other reasons are that WireLurker is a larger-scaled operation than previous families of Apple malware; it\u2019s only the second known threat capable of attacking iOS devices via USB (as in: while they are plugged into your Mac); it can automatically generate malicious applications; and it\u2019s also the first known malware capable of infecting already-installed iOS apps.<\/p>\n<blockquote class=\"twitter-pullquote\"><p>#WireLurker Apple #malware infects #OSX machines then transmits itself to #iOS devices via USB connection<\/p><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fkas.pr%2F4KXC&amp;text=%23WireLurker+Apple+%23malware+infects+%23OSX+machines+then+transmits+itself+to+%23iOS+devices+via+USB+connection\" class=\"btn btn-twhite\" data-lang=\"en\" data-count=\"0\" target=\"_blank\" rel=\"noopener nofollow\">Tweet<\/a><\/blockquote>\n<p>The way WireLurker works is that it moves to infect Mac machines by standard infection vectors. Then it waits for the user to plug their iOS device into their Mac\u2019s USB port. Once that happens, WireLurker begins installing malicious applications on the iOS device. In particular, it seeks out three popular apps \u2014 the Chinese varieties of eBay, PayPal and a popular photo editor. It then uninstalls the legitimate version of those apps and replaces them with malicious ones.<\/p>\n<div id=\"attachment_6571\" style=\"width: 709px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2014\/11\/05102756\/wirelurker-install.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-6571\" class=\"wp-image-6571 size-full\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2014\/11\/05102756\/wirelurker-install.png\" alt=\"Infected WireLurker applications installation screen (image from Palo Alto Networks report)\" width=\"699\" height=\"418\"><\/a><p id=\"caption-attachment-6571\" class=\"wp-caption-text\">Infected WireLurker applications installation screen (image from <a href=\"https:\/\/www.paloaltonetworks.com\/content\/dam\/paloaltonetworks-com\/en_US\/assets\/pdf\/reports\/Unit_42\/unit42-wirelurker.pdf\" target=\"_blank\" rel=\"noopener nofollow\">Palo Alto Networks report<\/a>)<\/p><\/div>\n<p>Researchers said initially that WireLurker is under active development, so it will likely change and it\u2019s impossible to say what its real purpose is at this point. Shortly before publication, Palo Alto Networks told Threatpost that Apple moved fast to revoke WireLurkers\u2019 malicious certificates and that its authors have since completely shut down their malware operation.<\/p>\n<p>Palo Alto Networks is offering a variety of tips about how to keep WireLurker off your networks. Most of the advice is enterprise-oriented, but there\u2019s some stuff we\u2019d like to reiterate so that you can protect your personal machines:<\/p>\n<p>1. Run an antivirus product and keep it updated.<\/p>\n<p>2. Check out your OS X \u201csystem preferences\u201d then \u201csecurity and privacy\u201d and set it up so that you only allow downloads from the App Store and identified developers (see short video below).<\/p>\n<span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe class=\"youtube-player\" type=\"text\/html\" width=\"640\" height=\"390\" src=\"https:\/\/www.youtube.com\/embed\/d0_qDLdAG4I?version=3&amp;rel=1&amp;fs=1&amp;showsearch=0&amp;showinfo=1&amp;iv_load_policy=1&amp;wmode=transparent\" frameborder=\"0\" allowfullscreen=\"true\"><\/iframe><\/span>\n<p>3. On that note: don\u2019t download apps from third party marketplaces.<\/p>\n<p>4. Keep iOS and OS X updated.<\/p>\n<p>5. Be careful about charging your iOS device by plugging it into computers other than your own.<\/p>\n<p>Our friends here at Kaspersky Lab are investigating WireLurker as we speak and will have their own analysis of it on Securelist later today. That said, Kaspersky Lab products detect and block this threat as Trojan-Downloader.OSX.WireLurker.a, so you should be protected.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Apple malware targets iOS by infecting OS X machines and then swapping legitimate apps for malicious ones as soon as an iOS device connects via USB. <\/p>\n","protected":false},"author":42,"featured_media":4255,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5],"tags":[14,656,802,1061,832,833,27,34,555,114,521],"class_list":{"0":"post-4254","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"tag-apple","9":"tag-apple-malware","10":"tag-apple-security","11":"tag-ios","12":"tag-ios-malware","13":"tag-ios-security","14":"tag-itunes","15":"tag-mac","16":"tag-mobile-2","17":"tag-os-x","18":"tag-threats"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/wirelurker-ios-osx-malware\/4254\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/wirelurker-ios-osx-malware\/4327\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/wirelurker-ios-osx-malware\/4781\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/wirelurker-ios-osx-malware\/5020\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/wirelurker-ios-osx-malware\/5941\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/wirelurker-ios-osx-malware\/6563\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/wirelurker-ios-osx-malware\/5373\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/wirelurker-ios-osx-malware\/5941\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/wirelurker-ios-osx-malware\/6563\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/wirelurker-ios-osx-malware\/6563\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/apple\/","name":"apple"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/4254","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/42"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=4254"}],"version-history":[{"count":1,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/4254\/revisions"}],"predecessor-version":[{"id":6570,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/4254\/revisions\/6570"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/4255"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=4254"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=4254"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=4254"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}