iOS App Store Hack: 5 Things You Should Know

Hundreds of iPhone apps have been affected with malware over the weekend. Here’s what you need to know about the recent iOS App Store hack.

One thing that makes iOS really great is how strict Apple is with App Store app submissions. Many see this as a hindrance to the iOS platform, but it helps to keep malware out of the iTunes App Store, unlike Google Play where guidelines aren’t quite as strict.

This means that there’s very little chance that iPhone apps could come with any kind malware, since Apple reviews each app to see if it meets the company’s rules and guidelines, so it’s much more difficult to release an iPhone app with malware on it than an Android app, although both platforms are prone to malware.

Case in point, it turns out that a handful of iPhone apps ended up getting infected with malware over the weekend and were able to get through Apple’s checkpoints. From there, users who downloaded any of the apps that were infected were now vulnerable to the malware.

Here’s what you need to know about the iOS App Store hack and see if you’ve been affected, as well as what you can do to stay safe in the future.

What the Malware Does

The malware goes by the name of XcodeGhost, and it’s said that the malware essentially steals user information and sends it to their own servers.

It’s able to send fake alerts to users on infected devices that would trick them into revealing various personal information.

The malware can also peak at users’ clipboards where copied information is stored until it’s pasted, which may not seem too harmless, but it would have the potential to see login information that was copied to the clipboard from a password management app.

How the Malware Got There

The malware is included inside of a malicious, counterfeit version Xcode that’s been going around in China. The maker of the counterfeit version has been persuading app developers to download the tool.

Xcode is Apple’s official development tool for creating apps on iOS and OS X, but a handful of app developers in China downloaded an unofficial version of Xcode from a third-party source that ended up including this malware.

From there, any apps that developers made were automatically infected with the malware without the app developer knowing. The app then gets submitted to Apple where it was somehow able to get by Apple’s various filters.

All that needed to happen next was for iPhone users to download the infected apps and the rest was history.

Infected Apps

Most of the apps that were infected with the malware were Chinese apps that were only available on the Chinese App Store, but there are still a few that users were able to download from the US App Store, including CamCard, WinZip, and even the new Angry Birds 2 game.

These apps have since been removed from the App Store, so you can’t download them now, but it’s certainly a bit surprising that a couple of big apps were infected with the malware.

The exact number of apps affected isn’t quite known, as some reports have said it’s a couple hundred apps, while other reports have said it’s less than 100 apps.

Again, though, most of the apps were Chinese and aren’t available on the US App Store, but it’s still something that many users were affected by.

Who Is Affected?

Essentially, anyone who downloaded any of the infected apps are affected by the malware, and if you didn’t download any of the apps, then you’re safe. It’s as simple as that.

The XcodeGhost malware has the potential to affect over 500 million iOS users, most of which are located in China and Asia. The messaging app WeChat is very popular over there, and that seems to be one of the biggest culprits of the malware.

How to Stay Safe in the Future

Obviously, users should uninstall any of the infected apps from their devices if they have them installed. However, once the app is updated and removed the malware, they’re safe to download again.

It’s also a good idea to change your passwords, including your Apple ID and iCloud password, so that if your information was compromised, you can at least put an end to any further damage. Getting your information compromised isn’t any fun, but you’ll now at least be prepared in the future for when another malware attack hits.