bodyType

customContents

entityId

entityUuid

articlePageQuery

filter

article

articleBaseAdvertisingInfoArticle

articleListArticle

articleSeoArticle

hooksArticleAcknowledgementGateOverlayArticle

hooksTrackPageViewArticle

hooksContentInterestArticle

articleLinkingDataContent

hooksAmpRedirectArticle

articleSchemaContent

liveArticle

advertZone

sentiment

contentLock

topics

types

sections

paywallTypes

createdDate

publishedDate

sponsorType

urlAlias

moreOnThisArticles

commentCount

authorLocations

authors

corrections

displaySlideShow

multimediaEmbed

printHeadline

seriesContainer

articleSpeeches

socialHeadline

headline

images

flag

firstTopic

glossary

flattenTypeIds

image

relatedLinks

relatedNewsletters

__typename

sponsor

pdfFiles

seriesReverseOrder

series

disableOffPlatformContent

published

updatedDate

summary

subHeadline

body

keywords

readingTime

customTimezone

liveContents

Hackers targeting jail-broken iPhones have raided more than 225,000 Apple accounts, using them for app-buying sprees or to hold phones for ransom, and Chinese users seem particularly vulnerable, researchers said.
Jail-broken means modified to run apps not sanctioned by Apple.
“We believe this to be the largest known Apple account theft caused by malware,” computer security firm Palo Alto Networks said in a blog post on Tuesday. Most of the victims are believed to be Chinese.
An attack using malicious code dubbed “KeyRaider” was discovered by WeipTech, an amateur technical group from Weiphone, described as one of the largest Apple fan websites in China, according to Palo Alto Networks.
In July, WeipTech members began investigating reports that some people’s Apple accounts were used to make unauthorised purchases or application installations.
WeipTech worked with Palo Alto Networks to uncover KeyRaider.
KeyRaider is being distributed through Cydia repositories in China but may be affecting users in 18 countries including France, Australia, and the United States, according to Palo Alto Networks.
Cydia repositories are locations where software for jail-broken iPhones can be found and installed.
Palo Alto Networks said the malware had been deliberately downloaded more than 20,000 times, “which suggests around 20,000 users are abusing the 225,000 stolen credentials”.
The blog posting said that Palo Alto Networks had sorted the email addresses from the stolen Apple IDs. More than half of them used email service provided by the Chinese internet firm Tencent. Six of the top ten email domains used by the victims are primarily used by Chinese users.
KeyRaider targets Apple mobile devices that have been jail-broken, or altered to run applications or other software not sanctioned by the California-based maker of iPhones, iPads, and iPods.
While investigating KeyRaider, WeipTech discovered an online server with passwords and other information from more than 225,000 Apple accounts, according to Palo Alto Networks.
The malicious code steals Apple account information by intercepting iTunes traffic and App Store purchase data. It can also be used to thwart users from unlocking iPhones or iPads, according to researchers.
“In addition to stealing Apple accounts to buy apps, KeyRaider also has built-in functionality to hold iOS devices for ransom,” Palo Alto Networks said.
“It’s important to remember that KeyRaider only impacts jail-broken iOS devices.”
Apple responded to the news by stressing that it makes a priority of security and that the App Store is curated to make sure software developers stick to guidelines set by the company.
“iOS is designed to be reliable and secure from the moment you turn on your device,” an Apple official said.
“This issue only impacts those who not only have jail-broken devices, but have also downloaded malware from untrusted sources.”
Apple added that it is helping those affected by KeyRaider to reset iCloud accounts with new passwords.


Hackers hit jail-broken iPhones, in biggest malware attack on Apple accounts

The hackers have mainly hit Chinese iPhone users, judging from the targeted email domains. Photo: AFP

News

World

Tech