The XcodeGhost malware, which infects iOS apps using a modified version of Xcode, has now evolved, bringing support for Xcode 7 and iOS 9.
[alert variation=”alert-success”]Xcode is a complete software development environment that provides all the tools needed to create, test, and debug applications for Apple's iOS and OS X platforms.[/alert]
According to security experts, the advanced version of the malware is being used to infect Apple devices, targeting more and more US agencies and organizations.
The new version of the malware was detected by FireEye and has been codenamed XcodeGhost S.
According to FireEye, the advanced version of XcodeGhost has been designed to be compatible with the new functions and features added to iOS 9. In addition, a new mechanism has been added that helps effectively conceal the malware's functions, making it impossible to detect.
More specifically, the creators of XcodeGhost S modified the code appropriately in order to bypass the restriction introduced in iOS 9 regarding the mandatory use of HTTPS connections, preventing the smooth transmission of data between XcodeGhost and the C&C servers. In addition, XcodeGhost now uses a new technique to successfully bypass static malware detection tools and conceal its C&C servers: Instead of hardcoding its location, XcodeGhost S now dynamically constructs the URL, character by character.
[signoff icon=”icon-target”]According to FireEye, at least one new app infected with XcodeGhost S has been detected on the App Store so far, which has now been removed from the online store.[/signoff]
In addition to the new variant, FireEye has also documented the use of older versions of XcodeGhost to target US businesses and organizations. The researchers note that cybercriminals are targeting organizations in the education, technology, manufacturing, and financial sectors, while the telecommunications, retail, and e-commerce sectors are also being targeted.
