Advisories

CERT-In Advisory CIAD-2014-0066

Apple iOS Improper Application Certificate Enforcement Vulnerability

Original Issue Date: November 14, 2014

Severity Rating: High

Systems Affected

Apple iOS version 7.1.1
Apple iOS version 7.1.2
Apple iOS version 8.0
Apple iOS version 8.1
Apple iOS version 8.1.1 Beta

Note: Other iOS versions may also be affected

Overview

A vulnerability has been reported in Apple iOS which allows any iOS application that is installed using enterprise/ad-hoc provisioning to replace any legitimate iOS application installed through the App Store with any other malicious application. This attack is also known as "Masque Attack" technique against Apple iOS.

Description

This vulnerability is caused due to iOS do not properly enforce matching of certificates for apps with the same bundle identifier.

A remote attacker could exploit this vulnerability by tricking the victim into installing an application from a source other than the iOS App Store or their organization's provisioning system. Attacker could then utilize this application to replace other legitimately installed applications, except iOS preinstalled applications, with any malicious application that uses the bundle identifier of the legitimate application thus bypassing the App Store review process.

Successful exploitation of this vulnerability could allow remote attacker to steal sensitive information from the device, monitor user activities, gain root privileges on the device and launch further attacks.

Countermeasures

Don't install apps from third-party sources other than Apple's official App Store or your own organization.
Don't click "Install" on a pop-up from a third-party web page
Carefully read iOS notification while opening applications, if iOS shows an "Untrusted App Developer" alert, click on "Don't Trust" and uninstall the application immediately.
Apple iOS 7 users could also check the enterprise provisioning profiles installed on their iOS devices by checking "Settings -> General -> Profiles" for "PROVISIONING PROFILES" and report any suspicious provisioning profiles to their security department.

References

US-CERT
https://www.us-cert.gov/ncas/alerts/TA14-317A

FireEye
http://www.fireeye.com/blog/technical/cyber-exploits/2014/11/masque-attack-all-your-ios-apps-belong-to-us.html

Virus Bulletin
https://www.virusbtn.com/pdf/conference/vb2014/VB2014-WeiZhengXueSong.pdf

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India