‘Masque Attack’ Vulnerability Allows Malicious Third-Party iOS Apps to Masquerade as Legitimate Apps

Just a week after new WireLurker iOS malware surfaced, there’s yet another vulnerability in iOS that can potentially be used to install malicious third-party apps. Called Masque Attack for its ability to emulate and replace existing legitimate apps, the flaw was discovered by security research company FireEye.

Masque Attack works by luring users to install an app outside of the iOS App Store, by clicking a phishing link in a text message or email. For example, in a demo video, an SMS message with a link attached was sent with the following text “Hey, check this out, the New Flappy Bird.”

Once clicked, the link directs to a website, which prompts the user to install an app. The app in the video isn’t Flappy Bird, but a malicious version of Gmail that installs directly over the legitimate version of Gmail downloaded from the App Store, making it virtually undetectable.

Masque Attack can be used to install fake versions of apps over legitimate App Store versions using iOS enterprise provision profiles, which are used for beta testing or by companies to distribute apps to employees without the need for the official App Store.

As explained in a blog post, as long as both the existing App Store app and the malicious imposter app use the same bundle identifier (a unique identifying number), the fake version will replace the actual app in a way that’s very difficult for the user to detect. The hidden malicious app is able to upload email messages, SMS messages, phone calls, and more, which is possible because “iOS doesn’t enforce matching certificates for apps with the same bundle identifier.”

While the attack cannot replace stock Apple apps like Safari and Mail, it is able to affect apps that have been installed via the App Store, and has the potential to be much more dangerous than other vulnerabilities like WireLurker.

Masque Attacks can pose much bigger threats than WireLurker. Masque Attacks can replace authentic apps,such as banking and email apps, using attacker’s malware through the Internet. That means the attacker can steal user’s banking credentials by replacing an authentic banking app with an malware that has identical UI. Surprisingly, the malware can even access the original app’s local data, which wasn’t removed when the original app was replaced. These data may contain cached emails, or even login-tokens which the malware can use to log into the user’s account directly.

FireEye has gotten the attack to work on iOS 7.1.1, 7.1.2, 8.0, 8.1, and the 8.1.1 beta. The company notified Apple about the vulnerability on July 26, but iOS users can protect themselves by not installing apps from third-party sources other than the official App Store, avoiding clicking on “install” popups in SMS messages or third-party websites, and avoiding apps/uninstalling apps that give an “Untrusted App Developer” alert.

iOS 7 users can check to see if they’ve been the victim of an attack by going to Settings –> General –> Profiles to see what provisioning profiles are installed. iOS 8 devices do not show installed provisioning profiles, making it more difficult to detect an attack.

Imagination Announces PowerVR Series7 Graphics, Likely Headed for Apple’s 2015 iOS Devices [iOS Blog]

Imagination Technologies today announced the launch of its next-generation PowerVR Series7 graphics architecture, setting the stage for further improvements to the graphics used in Apple’s iOS device lineup.

Series7XT and Series7XE GPUs achieve up to a 60% architectural performance increase on the latest industry standard benchmarks compared to equivalent configurations of previous generation PowerVR Series6XT/6XE GPUs, maintaining and extending PowerVR’s reputation as the most efficient, highest performance, lowest power GPU.

Of most interest to Apple users is the Series7XT family, which will be the successor to the Series6XT graphics used in Apple’s latest A8-series chips. The new Series7XT family ranges from two to 16 shading clusters offering up to 512 cores of graphics processing power, giving developers the ability to include “console-quality effects” such as HDR and 4K rendering in their mobile apps.

– PowerVR GT7200: 2 shading clusters, 64 ALU cores
– PowerVR GT7400: 4 shading clusters, 128 ALU cores
– PowerVR GT7600: 6 shading clusters, 192 ALU cores
– PowerVR GT7800: 8 shading clusters, 256 ALU cores
– PowerVR GT7900: 16 shading clusters, 512 ALU cores

Apple currently uses quad-core GX6450 graphics in its A8 chip for the iPhone 6 and 6 Plus, and more powerful six-core GX6650 graphics in the A8X chip found in the iPad Air 2.

Table adapted from AnandTech
PowerVR graphics architectures have typically taken on the order of 18 months from announcement of licensing to their appearance in products, but things moved much faster with the current Series6XT offerings. Those were announced in January at CES 2014 but made their way into Apple’s A8 chip in the iPhone 6 and 6 Plus just eight months later, suggesting the new Series7XT graphics could appear in next year’s A9 chips from Apple.

Imagination and Apple have worked closely together over the years, with Apple being a key investor in the graphics firm as it raised its stake to roughly 10 percent in mid-2009.