FireEye has uncovered a new bug – the Masque Attack – that could take over iOS apps.
The company writes on its corporate blog that it notified Apple back in July 2014 about a vulnerability whereby an iOS app installed using enterprise/ad-hoc provisioning could replace another genuine app installed through the App Store, as long as both apps used the same bundle identifier.
This in-house app may display an arbitrary title that lures the user to install it, but the app can replace another genuine app after installation. All apps can be replaced except iOS preinstalled apps, such as Mobile Safari, FireEye writes.
The bug, dubbed Masque Attack, can exist on jailbroken or non-jailbroken devices and can attack through wireless networks and USB.
However, the recent discovering of the WireLurker malware shows that it uses a limited for of Masque Attack to attack iOS devices through USB.
Masque Attacks can pose much bigger threats than WireLurker, says FireEye, as they can replace authentic apps, such as banking and email apps, using attacker’s malware through the Internet. That means the attacker can steal user’s banking credentials by replacing an authentic banking app with malware that has an identical UI.
FireEye warns that Masque Attack could have wide-reaching security impacts.
