Tag: YiSpecter

Solutions

[Chinese Version] YiSpecter: Another iOS Malware That Attacks Non-jailbroken Apple iOS Devices

Posted on by Eric Tay

3周前，帕洛阿尔托单位 42 发布 IOS XCodeGhost 恶意软件已经感染苹果商店内的39个软件。 现在他们又发布了新的恶意软件 YiSpecter感染苹果非越狱的 iPhone 和 iPad。 YiSpecter 使用许多的攻击媒介来实现黑客攻击。最大的区别是它使用企业证书及私人的 API 。

这一级别的复杂通常是与先进的持久性威胁（APT），而不是简单的感染有关。但由于苹果商店有非常严格的检查，我猜他们要去这一级别的成熟才会感染非越狱设备。

我不是说这个公司 （YingMob Interaction）的科技真的很好。因为这5年来已经有很多这类型的恶意软件被广泛使用。

总之，YiSpecter 主要针对在中国及台湾的 iPhone 及 iPad 用户。也许黑客只针对通过简化中文用户。YiSpecter 开始是从受感染的网站，Windows 的腾讯 QQ 聊天软件，和论坛内发出的HTML文件，目标是在 IOS 屏幕上显示色情网址。

在 IOS 8 设备上，如果用户单击对话框中让网址下载应用程序，它是自动安装，因为它包含一个偷来，但有效的企业证书。在 IOS 9，您必须切换的权限来安装企业应用程序，所以新用户受到保护。
然而，如果您已经从 IOS 8 升级，很可能你仍然感染。因为 YiSpecter 是自我保护，可以传播感染作为一个僵尸网络的一部分，而且它有隐藏的功能。

如果你想要知道更多关于YiSpecter的详情，请参见这篇文章的结尾。

要去毒，请按照说明：
  1. 在 iOS, 转到设置 ==》 通用 ==》描述文件，以删除所有未知或不受信任的配置文件;
  2. 删除这些软件，“情涩播放器”，“快播私密版” 或 “快播0”;
  3. 使用任何第三方 iOS 管理工具，例如 iFunBox 在 Windows 或者 Mac OS X，用来连接您的 iPhone 或 iPad（注意苹果 iTunes 不能使用）；
  4. 在管理工具中，检查所有已安装的 iOS 应用程序；如果有一些应用程序有名字，比如手机， 天气， 游戏中心， 存折， 笔记或 Cydia，请把它们删除。(请注意，此步骤不会影响原始系统应用程序，但只是伪造的删除恶意软件)。

资料来源:
YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs

0
Solutions

YiSpecter: Another iOS Malware That Attacks Non-jailbroken Apple iOS Devices

Posted on by Eric Tay

It’s less than 3 weeks since Unit 42 from Palo Alto published the IOS XCodeGhost malware that has infected 39 apps in Apple App Store. And they’re at it again! This time Unit 42 published findings on the malware YiSpecter, which uses many attack vectors with the key differentiator being Enterprise certificates & Private API to implement the hack.

This level of sophisticated is usually associated with Advanced Persistent Threat (APT)rather than a simple infection but since Apple Store has very strict checks, I guess they have to go to this level of sophistication in order to infect non-jailbroken devices.

Now I’m not saying that this malware company (YingMob Interaction) is really good, but they did “go the extra mile” to ensure a successful widespread infection by borrowing APT techniques published over the past 5 years.

In summary, YiSpecter mainly targets iPhone & iPad users in China & Taiwan, so maybe the hackers only target Simplified Chinese language users. The infection starts from infected websites, Windows-based IM platform like Tencent’s QQ Chat and forums where malicious HTML files are posted & displayed on the target IOS screen.

On IOS 8 devices, if the user click on dialog box to allow downloading the app, it is automatically installed because it contain a stolen but valid Enterprise certificate. On IOS 9, you have to switch on the permission to install Enterprise app, so new users are protected. However, if you’ve upgraded from IOS 8, it’s likely you’re still infected because YiSpecter is self-preserving, can spread the infection as part of a Botnet and is hidden from the user.

I wouldn’t go into the mechanism of the infection because it’s too technical for average users. You can find the link to the original Palo Alto notice at the end of the article.

To Clean the infection, you have to do the below:

  1. In iOS, go to Settings -> General -> Profiles to remove all unknown or untrusted profiles;
  2. If there’s any installed apps named “情涩播放器”, “快播私密版” or “快播0”, delete them;
  3. Use any third-party iOS management tool (e.g., iFunBox, though note that Apple’s iTunes doesn’t work in this step) on Windows or Mac OS X, to connect with your iPhone or iPad;
  4. In the management tool, check all installed iOS apps; if there’re some apps have name like Phone, Weather, Game Center, Passbook, Notes, or Cydia, delete them. (Note that this step won’t affect original system apps but just delete faked malware.)

Source:
YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs

0