A new type of attack called XcodeGhost is wreaking something of a mini-havoc in the App Store, injecting its malware payload into popular iPhone and iPad apps and prompting Apple to pull the infected apps.

The malware itself is pretty harmful—it collects and sends information about your device—but the method of spreading is cunning. Rather than target the App Store itself, attackers have distributed hacked versions of Xcode, Apple’s tool required for iOS and OS X development.

As Xcode is a multi-gigabyte download, developers in countries like China where Internet speeds are slow have downloaded these modified Xcode builds from non-Apple sources without realizing a hacked Xcode injects malware when compiling apps.

This morning, Apple issued an email to developers providing an update on the XcodeGhost situation while laying out easy-to-follow instructions for checking if their Xcode copy has been tampered with.

Apple’s message reads:

We recently removed apps from the App Store that were built with a counterfeit version of Xcode which had the potential to cause harm to customers. You should always download Xcode directly from the Mac App Store, or from the Apple Developer website, and leave Gatekeeper enabled on all your systems to protect against tampered software.

When you download Xcode from the Mac App Store, OS X automatically checks the code signature for Xcode and validates that it is code signed by Apple. When you download Xcode from the Apple Developer website, the code signature is also automatically checked and validated by default as long as you have not disabled Gatekeeper.

According to Apple’s marketing boss Phil Schiller, who is the steward of the firm’s relationship with app developers, “Apple knows of no cases where malicious apps transmitted user data.”

Here’s Apple’s message to developers.

Whether you downloaded Xcode from Apple or received Xcode from another source, such as a USB or Thunderbolt disk, or over a local network, you can easily verify the integrity of your copy of Xcode.

Furthermore, a post on Apple’s portal for developers contains additional instructions for validating copies of Xcode obtained elsewhere.

To verify the identity of your copy of Xcode, run the following command in Terminal on a Mac computer with the Gatekeeper feature enabled:

spctl --assess --verbose /Applications/Xcode.app

where /Applications/ is the directory where Xcode is installed.

Keep in mind that the above command line can take up to several minutes to complete the assessment for Xcode. Basically, the tool performs the same checks that Gatekeeper uses to validate the code signatures of applications.

It should return the following result for a version of Xcode downloaded from the Mac App Store:

/Applications/Xcode.app: accepted
source=Mac App Store

and for a version downloaded from the Apple Developer web site, the result should read either

/Applications/Xcode.app: accepted
source=Apple

or

/Applications/Xcode.app: accepted
source=Apple System

Any result other than ‘accepted’ or any source other than ‘Mac App Store’, ‘Apple System’ or ‘Apple’ indicates that the application signature is not valid for Xcode.

I’m not sure why anyone would download Xcode from a non-sanctioned source to begin with, but am certainly glad Apple is urging developers to download a clean copy of Xcode before submitting new apps and updates to the App Store.

Source: Apple

  • That_Fruitarian

    I don’t care how slow my downloads are, I would never trust these sites.

    • I’m finally getting 80 Dollars an hour,just working 4-7 hours daily online.…It’s time to take some action and you can join it too.It is simple,dedicated and easy way to get rich.Three weeks from now you will wish you have started today – I promise!

      ========>>>>> see link in My Disqus_Pr0f!le

      23

  • 5723alex .

    So, not only did these developers, including Rovio, downloaded illegitimate copy of Xcode, but they also disabled Gatekeeper ?

    • Sounds like these developers got what was coming. Downloading a copy of Xcode from somewhere else isn’t so bad when you consider why it was done (slow download speeds from Apple) however disabling Gatekeeper is a stupid idea.

  • Chris

    Like others, it still puzzles me as to how slow their download speeds really were. I’m still stuck on 1.5MB/s but it generally only takes just over an hour to download Xcode.

    • Lun Li

      I was in Shanghai this summer. I have the 20M service, which should give 2.5MB/s theoretically. When I actually connected to steam or Apple or whatever oversea service, the speed just varies, very unstable. Can be as high as 2.5MB/s or as low as 20KB/s, depending on the time of the day and how lucky you were. Maybe they got 20KB/s(~44hours to download 3GB)