You don't see a lot of malware for iPhones or iPads.
One reason for that is Apple's strict control over what you're allowed to install on your own device.
So it's intriguing to see an iOS malware analysis in specialist threat research publication Virus Bulletin (VB).
The malware, which Sophos products detect as iPh/AdThief-A, was apparently created with the express purpose of conducting online ad fraud.
Who is at risk?
Fortunately, AdThief only affects jailbroken devices.
Jailbreaking is where you go out of your way to remove Apple's security controls (ironically, usually by exploiting a security vulnerability) in order to win the freedom to do what you like with your iPhone or iPad.
Interestingly, to write a proper anti-virus for iOS that could block malware preventatively, you'd need to intercept important system calls such as "visit this URL," "open that file" and "run this app".
But to do that, you'd need to jailbreak.
And by jailbreaking, you'd also open up the risk of malicious apps intercepting system calls for criminal purposes.
According to VB, that's exactly what AdThief does, waiting for you to click on someone else's ad with someone else's affiliate code, and then putting the crook's affiliate code in there instead.
Affiliate codes are those curious looking text strings you put into advertisement URLs on your own website, so that if someone clicks on them, you get a referral fee from the ad network.
If a crook can switch out your affiliate code for his own, he essentially steals revenue that should have been yours.
The money in mobile ads
With lots of mobile apps, especially games, supported by in-app ads, there's plenty of money to be made if your app becomes popular.
For example, Dong Ngyuen, author of the erstwhile smash-hit game Flappy Bird, is said to have been pulling in up to $50,000 per day before he abruptly pulled the game from both the Apple App Store and the Google Play Store.
Ngyuen's revenues, of course, were helped by the enormous reach and brand power of Apple and Google, with millions of genuine users downloading his game.
That turned it into a cult classic almost overnight, which in turn fuelled yet more downloads, and yet more ad revenue.
Is jailbreak malware even worth it?
There isn't much iOS malware around, and most of it is for jailbroken devices only.
So, is money-making crimeware for the iPhone or iPad even worth it for the crooks?
The only true virus ever seen in the wild for iOS was Ikee, which Rickrolled you rather than trying to make money illegally.
Even though the author admitted that he tried to kickstart his virus by deliberately infecting a bunch of devices, and even though it could spread automatically by infecting across the network, Ikee fizzled out very quickly.
There were very few infections reported and little harm done in the end.
But AdThief has allegedly already infected about 75,000 jailbroken devices.
Even if the malware is only able to squeeze one cent a day in ad revenue out of 10% of its victims, that nevertheless comes out at a very handy $30,000 per year.
It might not be Flappy Bird territory, but it's not an amount to be sneezed at, either.
What to do?
We'd offer you a free copy of Sophos Anti-Virus and Security for iOS if we could; sadly, Apple says, "No."
Instead, we recommend that:
-->If you are a user, avoid jailbreaking your iDevice.
-->If you are a sysadmin, avoid letting jailbroken phones onto your network.
By the way, if you have jailbroken your iDevice, please be understanding if your sysadmin then says, "No."
Courtsey-- Naked Security
0 comments:
Post a Comment