XcodeGhost used unprecedented infection strategy against Apple

Hackers pulled off an unprecedented feat, lulling unwitting developers into loading thousands of iOS apps with adware, security experts said Friday.

“This is the first instance that I can recall,” said Raymond Wei, senior director of mobile development at FireEye, a Milpitas, Calif. network security firm, when asked whether a top-tier app system had ever been infected through first-party development tools.

Wei was referring to the hacking campaign, dubbed “XcodeGhost” by a Chinese researcher, that took a very unusual approach to getting malicious code into iOS apps distributed via Apple‘s App Store. Rather than inject attack code into a single app, then try to get that past Apple’s automated and human reviewers, the XcodeGhost hackers instead infected Xcode, Apple’s integrated suite of software development tools for crafting apps and applications for iOS and OS X.

To read this article in full or to leave a comment, please click here