XcodeGhost

XcodeGhost (and variant XcodeGhost S) are modified versions of Apple's Xcode development environment that are considered malware. The software first gained widespread attention in September 2015, when a number of apps originating from China harbored the malicious code. It was thought to be the "first large-scale attack on Apple's App Store", according to the BBC. The problems were first identified by researchers at Alibaba, a leading e-commerce firm in China. Over 4000 apps are infected, according to FireEye, far more than the 25 initially acknowledged by Apple, including apps from authors outside China.

Security firm Palo Alto Networks surmised that because network speeds were slower in China, developers in the country looked for local copies of the Apple Xcode development environment, and encountered altered versions that had been posted on domestic web sites. This opened the door for the malware to be inserted into high profile apps used on iOS devices.

Even two months after the initial reports, security firm FireEye reported that hundreds of enterprises were still using infected apps and that XcodeGhost remained "a persistent security risk". The firm also identified a new variant of the malware and dubbed it XcodeGhost S; among the apps that were infected were the popular messaging app WeChat and a Netease app Music 163.

Joe Rossignol (September 20, 2015). "What You Need to Know About iOS Malware XcodeGhost". macrumors.com. Archived from the original on 2015-11-04. Retrieved 2015-11-05.

1 2 "Protecting Our Customers from XcodeGhost". FireEye. Archived from the original on 26 October 2021. Retrieved 9 November 2021.

↑ Kirk, Jeremy (November 4, 2015). "Many US enterprises still running XcodeGhost-infected Apple apps, FireEye says". InfoWorld. Archived from the original on 2015-11-13. Retrieved 2015-11-05.

↑ "First mention of XcodeGhost on SinaWeibo". Sina Weibo. September 17, 2015. Retrieved 2015-11-11.

↑ Claud Xiao (September 18, 2015). "Malware XcodeGhost Infects 39 iOS Apps, Including WeChat, Affecting Hundreds of Millions of Users - Palo Alto Networks Blog". Palo Alto Networks Blog. Archived from the original on 2015-09-24. Retrieved 2015-11-11.

↑ Thomas Fox-Brewster (September 18, 2015). "Hackers Sneak Malware Into Apple App Store 'To Steal iCloud Passwords'". Forbes. Retrieved 2015-11-11.

↑ "Core Services Layer". developer.apple.com. Archived from the original on 2015-09-27. Retrieved 2015-11-11.

↑ "Inter-App Communication". developer.apple.com. Archived from the original on 2015-10-03. Retrieved 2015-11-11.

↑ Thomas, Brewster (Sep 18, 2015). "Hackers Sneak Malware Into Apple App Store 'To Steal iCloud Passwords'". Forbes. Archived from the original on Nov 25, 2016.

↑ "Validating Your Version of Xcode - News and Updates - Apple Developer". developer.apple.com. Retrieved 2015-11-11.