iOBD App Compromised.

[fairm010]

The Bluetooth OBD App iOBD2 (amongst other apps) has been found to have compromised code in it. If you have it installed, you are advised to remove it until there is an update addressing it.

http://forums.macrumors.com/threads...ios-malware-xcodeghost.1918784/#post-21896151

Infected iOS apps
网易云音乐 2.8.3
微信 6.2.5
讯飞输入法 5.1.1463
滴滴出行 4.0.0.6-4.0.0.0
滴滴打车 3.9.7.1 – 3.9.7
铁路12306 4.5
下厨房 4.3.2
51卡保险箱 5.0.1
中信银行动卡空间 3.3.12
中国联通手机营业厅 3.2
高德地图 7.3.8
简书 2.9.1
开眼 1.8.0
Lifesmart 1.0.44
网易公开课 4.2.8
马拉马拉 1.1.0
药给力 1.12.1
喜马拉雅 4.3.8
口袋记账 1.6.0
同花顺 9.60.01
快速问医生 7.73
懒人周末
微博相机
豆瓣阅读
CamScanner
CamCard
SegmentFault 2.8
炒股公开课
股市热点
新三板
滴滴司机
OPlayer 2.1.05
电话归属地助手 3.6.5
愤怒的小鸟2 2.1.1
夫妻床头话 1.2
穷游 6.6.6
我叫MT 5.0.1
我叫MT 2 1.10.5
自由之战 1.1.0

Fox-IT (fox-it.com), a Netherlands based security company, checked all C2 domain names from our reports in their network sensors and has found thousands of malicious traffic outside China. According to their data, these iOS apps were also infected:

Mercury
WinZip
Musical.ly
PDFReader
guaji_gangtai en
Perfect365
网易云音乐
PDFReader Free
WhiteTile
IHexin
WinZip Standard
MoreLikers2
CamScanner Lite
MobileTicket
iVMS-4500
OPlayer Lite
QYER
golfsense
同花顺
ting
installer
下厨房
golfsensehd
Wallpapers10000
CSMBP-AppStore
礼包助手
MSL108
ChinaUnicom3.x
TinyDeal.com
snapgrab copy
iOBD2
PocketScanner
CuteCUT
AmHexinForPad
SuperJewelsQuest2
air2
InstaFollower
CamScanner Pro
baba
WeLoop
DataMonitor
爱推
MSL070
nice dev
immtdchs
OPlayer
FlappyCircle
高德地图
BiaoQingBao
SaveSnap
WeChat
Guitar Master
jin
WinZip Sector
Quick Save
CamCard

 

[197.]

What is the function of this compromised code?

 

[fairm010]

No one knows yet, as no leaks of information have been found. It is suspected to be after personal details and App store login details.

 

[197.]

Wonder why Apple didn't pick this up. Although at least they're trying to sort it out.

 

[Knuckles]

Most of those affected apps sound dodgy as f**k anyway lol

 

[mace¬]

In English?

 

[197.]

Most of those affected apps sound dodgy as f**k anyway lol

Haha agreed. Although the pdf reader one I currently have installed. Had a look and it's been pulled off the app store

 

[fairm010]

Wonder why Apple didn't pick this up. Although at least they're trying to sort it out.

Its not the app themselves that were compromised, but the program used to build apps called XCode. The Chinese tend to download non-official versions rather than from Apples servers as that can be slow. The compromised Xcode has built malicious apps without the developers even knowing.

 

[fairm010]

Most of those affected apps sound dodgy as f**k anyway lol

I use 网易云音乐 quite frequently, it ships Nike trainers straight to my door.

 

[Knuckles]

I use 网易云音乐 quite frequently, it ships Nike trainers straight to my door.

lol, is it a personal courier service where a small Asian child delivers them to you?


...then won't leave

 

[fairm010]

It actually translates to Netease cloud music

 

[Goodj]

In Engrish?

Communist China is syphoning DK's bank account to fund their global expansion.

 

[mace¬]

Communist China is syphoning DK's bank account to fund their global expansion.

China wouldn't know what to do with all that cash.

 

[Goodj]

China wouldn't know what to do with all that cash.

Probably buy a load of Porsches without clutch pedals.

 

[DannyR]

Heard on radio and thought lovely won't effect me... One of our major works one we use is in there for CCTV, I-VMS 4500, brilliant!