{"id":5391,"date":"2016-03-31T05:48:09","date_gmt":"2016-03-31T09:48:09","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/?p=5391"},"modified":"2020-02-26T18:59:57","modified_gmt":"2020-02-26T14:59:57","slug":"acedeciever-mitm-attack","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/acedeciever-mitm-attack\/5391\/","title":{"rendered":"AceDeciever: the malware that can infect ANY iPhone"},"content":{"rendered":"<p>Apple iPhone users usually consider their phones as impregnable fortresses that Apple has built for them: iPhones are often said to be secure and safe, especially when compared to Android devices. Yes, iPhones are really\u00a0<i>more secure<\/i>\u00a0than Android phones, but that doesn\u2019t mean that they are\u00a0<i>totally secure<\/i>. You know, there are no fortresses that can not be conquered.<\/p>\n<p>We\u2019ve\u00a0<a href=\"https:\/\/www.kaspersky.com\/blog\/wirelurker-ios-osx-malware\/6563\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">already covered<\/a>\u00a0not\u00a0<a href=\"https:\/\/www.kaspersky.com\/blog\/ransomware_targets_ios_osx\/4903\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">just one<\/a>\u00a0but several nasty\u00a0<a href=\"https:\/\/www.kaspersky.com\/blog\/xcodeghost-compromises-apps-in-app-store\/9965\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">iOS threats<\/a>\u00a0and gave\u00a0<a href=\"https:\/\/www.kaspersky.com\/blog\/iphone-maximum-security-tips\/6132\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">some advice on securing your Apple gadgets<\/a>. However malware for iOS continues to emerge and the most recent sample\u00a0<a href=\"http:\/\/researchcenter.paloaltonetworks.com\/2016\/03\/acedeceiver-first-ios-trojan-exploiting-apple-drm-design-flaws-to-infect-any-ios-device\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">discovered by Palo Alto Networks<\/a>\u00a0seems to be one of the most dangerous so far.<\/p>\n<p>Why? Because it neither requires your iOS device to be jailbroken nor it uses some stolen corporate certificate to install malicious software. The new malware family is called AceDeciever and it is capable of infecting pretty much\u00a0<b>any<\/b>\u00a0iOS device.<\/p>\n<h3>The rather good intentions<\/h3>\n<p>Everything started with someone\u2019s novel idea not to pay for what they want to get. In this case it was a method to pirate iOS apps called FairPlay Man-in-the-Middle attack. We won\u2019t spend much time here explaining the concept of Man-in-the-Middle attacks \u2014 you can learn about them from a\u00a0<a href=\"https:\/\/www.kaspersky.com\/blog\/man-in-the-middle-attack\/1613\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">dedicated post here<\/a>. And here we\u2019d rather focus on what FairPlay is and how AceDeciever actually works.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Trojan Exploits Apple DRM Flaw, Plants <a href=\"https:\/\/twitter.com\/hashtag\/Malware?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Malware<\/a> On Non-Jailbroken <a href=\"https:\/\/twitter.com\/hashtag\/iOS?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#iOS<\/a> Devices: <a href=\"https:\/\/t.co\/n5MHIRbOn7\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/n5MHIRbOn7<\/a> <a href=\"https:\/\/t.co\/SluytGnjmJ\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/SluytGnjmJ<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/710219381712801793?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">March 16, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>FairPlay is the DRM protection that Apple uses for music and videos as well as for iOS apps. As you probably know, iPhone users can purchase apps in iTunes client on their computer and then transfer them to their phones. Of course, it requires proof that the user really had purchased the app. This proof is delivered via an authorization code generated by iTunes for every application. That\u2019s how FairPlay works.<\/p>\n<p>The thing is, the code is always the same for any given application. And if you\u2019ve managed to intercept it once, you can use it to install the same app to countless number of iPhones and iPads. That\u2019s basically how FairPlay Man-in-the-Middle works.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-5394\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2016\/03\/05103323\/acedeciever-mitm.png\" alt=\"acedeciever-mitm\" width=\"834\" height=\"407\"><\/p>\n<h3>The app with two faces<\/h3>\n<p>Eventually, the method had evolved into creating a full-featured pirate app store. It was based on a Windows program called Aisi Helper that initially was used to jailbreak iPhones, back up data and reinstall iOS. A new function was added to this tool \u2014 it started injecting an app with the same name into any iPhone connected to a computer with Aisi Helper installed. That app would display a lot of pirated apps that users could download for free.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">10 tips to make your <a href=\"https:\/\/twitter.com\/hashtag\/iPhone?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#iPhone<\/a> even more secure <a href=\"http:\/\/t.co\/FBaWOZY5W5\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/FBaWOZY5W5<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/security?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#security<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/privacy?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#privacy<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/516967503395037184?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">September 30, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Curiously, this Aisi Helper app itself was being installed to iPhones using the same FairPlay Man-in-the-Middle technique. That\u2019s why in order to inject Aisi Helper to iPhones creators of the app needed to upload it to App Store at first, to obtain a legitimate authentication code for this very app. The problem was, Apple doesn\u2019t really like pirate app shops in the App Store.<\/p>\n<p>To seduce Apple code reviewers, Aisi Helper pretended to be a harmless and boring free wallpapers app. To be sure nobody ever revealed the truth, the culprits used a double trick. On one hand, they published versions of this app only in US and UK App Stores , beyond the reach of Chinese users. On the other hand, when launched first time, the app checked phone\u2019s location and if it was not in China, it showed only wallpapers (and has done so since then).<\/p>\n<p>Hence to see the real pirate store interface US App Store code reviewers as well as any random user have to be in China which is very unlikely. That\u2019s why nobody ever noticed that the app is something more than yet another set of wallpapers.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Chinese Mobile Ad Library Backdoored to Spy on iOS Devices: <a href=\"https:\/\/t.co\/1kpMrH8HJC\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/1kpMrH8HJC<\/a> via @thretapost <a href=\"https:\/\/t.co\/0I1RTUEWln\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/0I1RTUEWln<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/661962442587643905?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">November 4, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>\u00a0<\/p>\n<p>Apple has by now removed all versions of the Aisi Helper app from the App Store. But it turns out that it doesn\u2019t mean the end of life for this malware. In order to perform a FairPlay Man-in-the Middle attack you don\u2019t actually need to have an app in the App Store. The requirement is that it\u00a0<i>has been there once<\/i>. And that\u2019s 100% true for Aisi Helper\u2019s \u2018wallpaper\/pirate-store apps\u2019.<\/p>\n<h3>The unFair Play<\/h3>\n<p>So what\u2019s wrong with a pirate app store aside from legal and moral issues? Well, if someone tells you something like: \u2018I\u2019ve stolen that and now I give it to you for free,\u2019 \u2014 don\u2019t believe it. Never. There\u2019s 99.9% chance that\u2019s you are being fooled.<\/p>\n<p>And that\u2019s exactly the case with this app. These apps were harmless for their users for a while. But at certain point, these apps started asking their users to input their Apple ID logins and passwords \u201cfor more features.\u201d After that those credentials were uploaded to AceDeciever\u2019s command server.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">7 <a href=\"https:\/\/twitter.com\/hashtag\/iPhone?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#iPhone<\/a> Apps for your Security <a href=\"http:\/\/t.co\/lFNTv8RxLM\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/lFNTv8RxLM<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/FindMyiPhone?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#FindMyiPhone<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/iOS?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#iOS<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/458250517022769152?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">April 21, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>\u00a0<\/p>\n<p>I think, now it\u2019s rather clear why are we talking about AceDeciever here on Kaspersky Daily. The flaw in FairPlay\u2019s security is still not patched. And even if it would be, the older OS version would probably remain vulnerable to the very same attack.<\/p>\n<h3>OK, how do I protect myself?<\/h3>\n<p>The good news is that this particular attack does not target people outside of mainland China. The bad news is that it\u2019s rather easy for bad guys to exploit this vulnerability once again and make some new malware that would target other countries and do even more harm. That is to say no matter whether you live in China or not, we suggest you do the following:<\/p>\n<p>1. Don\u2019t try to jailbreak your iPhone. It never was safe, and as you can see, the very software required to perform this operation is not safe as well.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Tips: Never root or jailbreak your device, only use official app market, read user review <a href=\"https:\/\/twitter.com\/hashtag\/relentless?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#relentless<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/obsession?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#obsession<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/mobile?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#mobile<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/kaspersky?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#kaspersky<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/359222332952297473?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">July 22, 2013<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>\u00a0<\/p>\n<p>2. We always have suggested to use this rule for Google Play, but it looks like it\u2019s suitable for App Store as well: pay attention to the apps you are installing. AceDeceiver\u2019s creators have proven that Apple code reviews can be bypassed with certain trickery. Unfortunately, antivirus software is not allowed in iOS, so once malware is inside, you\u2019re on your own.<\/p>\n<p>3. Fortunately, you can protect your other devices. Be sure to have good security solutions everywhere you can. In this example an\u00a0<a href=\"https:\/\/www.kaspersky.com\/advert\/multi-device-security?redef=1&amp;THRU&amp;reseller=gl_KDpost_pro_ona_smm__onl_b2c_kasperskydaily_lnk____kismd___&amp;_ga=1.131705997.300785052.1449065439\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">anti-virus software on the PC<\/a>\u00a0would have detected Aisi Helper as malicious AceDeciever.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Apple iPhone users usually consider their phones as impregnable fortresses that Apple has built for them: iPhones are often said to be secure and safe, especially when compared to Android<\/p>\n","protected":false},"author":696,"featured_media":5392,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,1486],"tags":[1157,14,1061,100,26,1158,1159,76,1160,521,692],"class_list":{"0":"post-5391","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"tag-acedeciever","10":"tag-apple","11":"tag-ios","12":"tag-ipad","13":"tag-iphone","14":"tag-man-in-the-middle","15":"tag-mitm","16":"tag-phishing","17":"tag-pirates","18":"tag-threats","19":"tag-trojans"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/acedeciever-mitm-attack\/5391\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/acedeciever-mitm-attack\/3777\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/acedeciever-mitm-attack\/6953\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/acedeciever-mitm-attack\/6975\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/acedeciever-mitm-attack\/7850\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/acedeciever-mitm-attack\/11452\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/acedeciever-mitm-attack\/11730\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/acedeciever-mitm-attack\/5492\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/acedeciever-mitm-attack\/7399\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/acedeciever-mitm-attack\/10893\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/acedeciever-mitm-attack\/11452\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/acedeciever-mitm-attack\/11730\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/acedeciever-mitm-attack\/11730\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/acedeciever\/","name":"AceDeciever"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/5391","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/696"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=5391"}],"version-history":[{"count":3,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/5391\/revisions"}],"predecessor-version":[{"id":16023,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/5391\/revisions\/16023"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/5392"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=5391"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=5391"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=5391"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}