Apple Targeted as Hackers Infect Popular Chinese Mobile Apps With Malware

By Dow Jones Business News,  September 20, 2015, 08:11:00 AM EDT

By Josh Chin

BEIJING--Some of the most popular Chinese names in Apple Inc.'sApp Store were found to be infected with malicious software in what is being described as a first-of-its-kind security breach, exposing a rare vulnerability in Apple's mobile platform, according to multiple researchers.

The applications were infected after software developers were lured into using a compromised version of Apple's developer tool kit, according to researchers at Alibaba Mobile Security, a mobile antivirus division of Alibaba Group Holding Ltd.

The list of recently compromised iPhone and iPad offerings includes Tencent Holdings Ltd.'s popular mobile chat app WeChat, Uber-like car-hailing app Didi Kuaidi, and a Spotify-like music app from Internet portal NetEase Inc.

The attack affected more than three dozen apps in all, according to U.S.-based cybersecurity firm Palo Alto Networks Inc.

The infected apps can transmit information about a user's device, prompt fake alerts that could be used to steal passwords to Apple's iCloud service, and read and write information on the user's clipboard, according to researchers.

Apple didn't have an immediate comment.

In separate statements posted to social media over the weekend, Tencent, Didi Kuadi Joint Co. and NetEase said their applications had been compromised but said no sensitive customer information had been lost.

"At present, we haven't discovered any loss of user information or assets as a result of this [breach], though the WeChat team will continue to monitor and do tests," Tencent said in a message posted to the Sina Weibo microblogging service late Friday. A new, clean update of the WeChat app had been uploaded to the app store, it said.

It is unusual for malware to spread through Apple's App Store, which typically subjects apps to stringent reviews. In a blog post Thursday, Palo Alto Networks said the attack was the first of its type directed at Apple's iOS mobile operating system. Chinese anticensorship activist group Greatfire.org called it "the most widespread and significant spread of malware" in the app store's history.

Other apps found infected with the malware include those belonging to state-run mobile carrier China Unicom, and 12306, the country's official train-booking website, researchers said. China Unicom and China's railway bureau did not immediately respond to faxed requests for comment Sunday.

It wasn't clear Sunday how the infected apps made it past Apple's screening process, or whether the breach had resulted in any user information being stolen, though researchers said millions of devices could have been exposed based on the popularity of the apps in question.

WeChat has more than 500 million active users, according to Tencent. It isn't clear how many use devices from Apple, which accounts for about 15% of China's smartphone market, according to researcher IDC.

The hack exploited Chinese developers' impatience, according to Palo Alto Networks. To write apps for Apple devices, developers have to use a tool kit called Xcode, but downloading the official version from Apple's website can take a long time in China.

The hackers posted their infected version on a Chinese server, advertising faster downloads, the researchers said. Any app created or altered using the bogus Xcode would then itself become infected with the malware, they said.

The infected Xcode was hosted on Baidu Pan, a cloud service offered by Chinese search giant Baidu Inc., according to multiple security researchers. Baidu removed the file shortly after being notified of its existence, Baidu spokesman Kaiser Kuo said Sunday.

The malware has been dubbed XcodeGhost by researchers at Alibaba Mobile Security, who were the first to document it extensively in a series of social media posts starting Thursday.

Even if the hackers didn't use the malware to steal anything, Palo Alto Networks warned it still represented a threat to the popular operating system. Security researcher Claud Xiao wrote on the firm's website Friday that criminals and spies could use the malware to gain access to iOS devices.

"We believe XcodeGhost is a very harmful and dangerous malware that has bypassed Apple's code review and made unprecedented attacks on the iOS ecosystem," he wrote.

Yang Jie contributed to this article.

Write to Josh Chin at josh.chin@wsj.com

Access Investor Kit for "Apple, Inc."

Visit http://www.companyspotlight.com/partner?cp_code=P479&isin=US0378331005

Subscribe to WSJ: http://online.wsj.com?mod=djnwires

(END) Dow Jones Newswires 09-20-150811ET Copyright (c) 2015 Dow Jones & Company, Inc.
Source: Apple Targeted as Hackers Infect Popular Chinese Mobile Apps With Malware