A new type of attack called XcodeGhost is wreaking something of a mini-havoc in the App Store, injecting its malware payload into popular iPhone and iPad apps and prompting Apple to pull the infected apps.
The malware itself is pretty harmful—it collects and sends information about your device—but the method of spreading is cunning. Rather than target the App Store itself, attackers have distributed hacked versions of Xcode, Apple’s tool required for iOS and OS X development.
As Xcode is a multi-gigabyte download, developers in countries like China where Internet speeds are slow have downloaded these modified Xcode builds from non-Apple sources without realizing a hacked Xcode injects malware when compiling apps.
This morning, Apple issued an email to developers providing an update on the XcodeGhost situation while laying out easy-to-follow instructions for checking if their Xcode copy has been tampered with.
Apple’s message reads:
We recently removed apps from the App Store that were built with a counterfeit version of Xcode which had the potential to cause harm to customers. You should always download Xcode directly from the Mac App Store, or from the Apple Developer website, and leave Gatekeeper enabled on all your systems to protect against tampered software.
When you download Xcode from the Mac App Store, OS X automatically checks the code signature for Xcode and validates that it is code signed by Apple. When you download Xcode from the Apple Developer website, the code signature is also automatically checked and validated by default as long as you have not disabled Gatekeeper.
According to Apple’s marketing boss Phil Schiller, who is the steward of the firm’s relationship with app developers, “Apple knows of no cases where malicious apps transmitted user data.”
Apple's Phil Schiller tells China's Sina website that Apple knows of no cases where malicious apps transmitted user data.
— CNBC Now (@CNBCnow) September 22, 2015
Here’s Apple’s message to developers.
Whether you downloaded Xcode from Apple or received Xcode from another source, such as a USB or Thunderbolt disk, or over a local network, you can easily verify the integrity of your copy of Xcode.
Furthermore, a post on Apple’s portal for developers contains additional instructions for validating copies of Xcode obtained elsewhere.
To verify the identity of your copy of Xcode, run the following command in Terminal on a Mac computer with the Gatekeeper feature enabled:
spctl --assess --verbose /Applications/Xcode.app
where /Applications/ is the directory where Xcode is installed.
Keep in mind that the above command line can take up to several minutes to complete the assessment for Xcode. Basically, the tool performs the same checks that Gatekeeper uses to validate the code signatures of applications.
It should return the following result for a version of Xcode downloaded from the Mac App Store:
source=Mac App Store
and for a version downloaded from the Apple Developer web site, the result should read either
Any result other than ‘accepted’ or any source other than ‘Mac App Store’, ‘Apple System’ or ‘Apple’ indicates that the application signature is not valid for Xcode.
I’m not sure why anyone would download Xcode from a non-sanctioned source to begin with, but am certainly glad Apple is urging developers to download a clean copy of Xcode before submitting new apps and updates to the App Store.