Feeds

Windows worm slips into iOS App Store, climbs into hipsters' pockets

Further proof that Instagram fanbois are diseased

Next gen security for virtualised datacentres

An item of Windows malware has managed to make its way onto Apple's iOS App Store. It's likely to have been an accidental screw-up, but it nonetheless raises concerns about Apple's app-screening process.

The malicious Windows executable was found by a user who downloaded an app called "Instaquotes-Quotes Cards For Instagram" from iTunes before his security software warned him that the file was infected with a worm. A closer look at the incident, which might have easily been a false alarm by his security software, a not infrequent occurrence, revealed that the threat was all too real.

The file contained a worm variously identified as CoiDung-A by Sophos, Worm-VB-900 by ClamAV and VB-CB by Microsoft. Apple pulled the Instaquotes app from the iOS App Store on Tuesday, shortly after it emerged that the app was tainted with malware. The worm at the centre of the security flap is quite old, and hence widely detected, and not especially potent.

The user who downloaded the app posted his discovery on the Apple Support Communities discussion board, where other users were quickly able to confirm that warnings generated by security software were well-founded.

MacRumors reports that the price of the app, which has been available since 19 July, was reduced from $0.99 to free this last weekend. It's unclear how many people download the app.

The malware can't actually run on a Windows PC without first being extracted from the iOS application package, a factor that means it is unlikely even those Mac users who downloaded the app could spread it to their Windows by infecting friends and colleagues. And, of course, iPhones and iPads can't run Windows programs. The tainted app can't infect a Mac OS X machine either.

What's worse than a worm inside an Apple?

The spread of the malware was probably caused by the accidental infection of a developer's computer, although deliberate infection can't immediately be ruled out. The tainted app made it through Apple's approval process, which has to be the main area of concern.

"Perhaps what's most disappointing about the discovery of Windows malware inside an iOS app is that Apple doesn't seem to have conducted a simple virus scan as part of its app-vetting process," notes Joshua Long, in a post on Sophos' Naked Security blog. "Just extracting all files from the package, and scanning them with anti-virus software, would have prevented the Windows malware from getting into the iOS App Store in the first place."

Earlier this month, Apple approved another questionable iOS app. Find and Call collected contact information from smartphones before uploading this data and sending SMS text message spam to a user's contacts, all without warning the user or asking for permission.

The malware embedded in Instaquotes cannot cause any direct harm to Apple smartphones and tablets, unlike Find and Call. However the appearance of a tainted copy of Instaquotes just weeks after the Find and Call security flap suggests it would be unwise to assume Apple's iOS App Store "walled garden" was impregnable.

In fairness it ought to be pointed out iOS malware, certainly on devices that have not been jailbroken, had been virtually unheard of for five whole years from the launch of the App Store up until the start of this month – a huge achievement. ®

Bootnote

Users of Mac desktops who are conscious about internet hygiene often run anti-virus software for much the same reason that it's a useful addition on Linux file-servers and mail-servers: to clear out any Windows-based malware. Even though these machines can't catch a Windows bug they can become "Typhoid Marys" that spread infection. The Flashback Trojan finally proved that Mac malware was a problem and isolated cases of Linux worms have cropped up occasionally for years, but Windows malware remains the biggest enemy.

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.