Lookout Blog

Lookout Security describes it as malware[2] and as malicious, as does Palo Alto Networks[3], Ars[4], Reuters[5] and The NY Times[6].

From here[1]:

> Remote control security risks

> XcodeGhost can be remotely controlled via commands sent by an attacker from a Command and control server through HTTP. This data is encrypted using the DES algorithm in ECB mode. Not only is this encryption mode known to be weak, the encryption keys can also be found using reverse engineering. An attacker could perform a man in the middle attack and transmit fake HTTP traffic to the device (to open a dialog box or open specific app for example).

> Read and write from clipboard

> XcodeGhost is also able, each time an infected app is launched, to store the data written in the iOS clipboard. The malware is also able to modify this data. This can be particularly dangerous if the user uses a password management app.

> Hijack opening specific URLs

> XcodeGhost is also able to open specific URLs when the infected app is launched. Since Apple iOS and OS X work with Inter-App Communication URL mechanism (e.g. 'whatsapp://', 'Facebook://', 'iTunes://'), the attacker can open any apps installed on the compromised phone or computer, in the case of an infected macOS application. Such mechanism could be harmful with password management apps or even on phishing websites.

> Stealing user device information

> When the infected app is launched, either by using an iPhone or the simulator inside Xcode,…

> I think it won't be too long until they can dust your fingerprints, take a picture of it, then have it 3d printed on a substrate that will fool a simple fingerprint scanner.

I'm struggling to find good references right at this moment - but I've seen reports/video of this being done using more basic means, years ago. But I may be misremembering details.

It seems that it's already possible to produce usable fingerprints using a laser printer, printable transparencies (i.e for overhead projectors), and some glue.

The idea is that you print the inverted fingerprint on a transparency. Because the transparency doesn't allow the toner to absorb in, it remains on the surface as a 3D structure.

You then apply glue to that structure, and wait for it to cure. After it cures it can be removed and trimmed to fit your finger, and then applied to your finger.

This apparently is reliable enough to fool basic fingerprint scanners, even ones with 'liveness' checks for conductivity/pulse because the glue is conductive and transparent enough for those basic checks.

Examples of similar things:

https://blog.lookout.com/why-i-hacked-apples-touchid-and-still-think-it-is-awesome

https://www.instructables.com/How-To-Fool-a-Fingerprint-Security-System-As-Easy-/

Relevant : https://blog.lookout.com/blog/2013/09/23/why-i-hacked-apples-touchid-and-still-think-it-is-awesome/

Quoting from this article,"Hacking TouchID relies upon a combination of skills, existing academic research and the patience of a Crime Scene Technician.

It is certainly not something your average street thief would be able to do, and even then, they would have to get lucky. Don’t forget you only get five attempts before TouchID rejects all fingerprints requiring a PIN code to unlock it. However, let’s be clear, TouchID is unlikely to withstand a targeted attack. A dedicated attacker with time and resources to observe his victim and collect data, is probably not going to see TouchID as much of a challenge. Luckily this isn’t a threat that many of us face.

TouchID is not a “strong” security control. It is a “convenient” security control. Today just over 50 percent of users have a PIN on their smartphones, and the number one reason people give for not using the PIN is that it’s inconvenient. TouchID is strong enough to protect users from casual or opportunistic attackers (with one concern I will cover later on) and it is substantially better than nothing."

Apps can be sideloaded on iOS really easily. There's a whole community of people (https://reddit.com/r/sideloaded) around modifying apps and sideloading them. https://ipasigner.io is an example - just click the app you want to install, go into iOS settings and give permissions to the cert, and boom you have a new sideloaded app installed. Takes less than a minute, no computer required.

It used to be even simpler in iOS 8, but Apple complicated the process a little bit for valid security reasons:
https://blog.lookout.com/ios-9-sideloading

The only friction is that the sideloaded apps will only work for 7 days unless you (or someone else like on ipasigner.io) have a paid developer account.

If you want to sideload your own apps, Cydia Extender is a great tool.

If they have access to a live finger for the TouchID, sure they can bypass - but they could do that with the $5 guaranteed coercion method as well [1].

Copying a good fingerprint from a dead finger or a randomly placed print is not easy [2]. It's hard, doable but you get 5 tries so if you screw up, you have thrown away all the hard work of the print transfer.

All bets are off if the iPhone is power-cycled. Best bet if you're pulled over by authorities or at a security checkpoint is to turn off your iPhone (and have a strong alphanumeric passcode).

[1] https://xkcd.com/538/
[2] https://blog.lookout.com/blog/2013/09/23/why-i-hacked-apples-touchid-and-still-think-it-is-awesome/

One of the arrested ones is 20, and he allegedly created Dendroid — a malware that can take remote control of an Android device. He designed, developed and deployed this software (bypassing Google Play's malware detection system) which seems to be quite complex and capable [0]. This proves that he possess a certain set of marketable skills that are quite south after in the industry.

So I'm wondering - is this really bad news for them, or will it just bring them enough spotlight to be contacted for some security roles that pay better than what they were earning prior to the arrest?

[0] https://blog.lookout.com/blog/2014/03/06/dendroid/