News Apple App Store hit by XcodeGhost malware infection

You say it's difficult to blame Apple, but shouldn't malicious code automatically injected into a well meaning app be the sort of thing that would be picked up by effective automated scanner.
As opposed to an app built from the ground up to perform malicious actions where this appoach may be less effective.

 

i-users questioning Apple? You're hilarious Gareth!

 

Well there is... It's called heuristic scanning. And while obviously I don't know the exact nature of the beast, I'd have thought code automatically injected into and existing trusted source via an update is the sort of thing a good heuristic scanner would be designed to detect.

Indeed, we're largely not talking about scanning for existing viruses here at all. When it comes to apps the problem can just as well be malicious code written by the dev within apps created by them that have not been distributed else where at all.
The idea of relying on existing signatures in this context is obviously not very useful.

 

No doubt the devs are just as culpable but if it wasn't for Apple's walled-garden approach would this have even happened in the first place?

By that I mean it was Apple who insisted (I'm guessing) that apps can only be written and publish if they were programed using Apple's own Xcode package, basically Apple created a system with a single point of failure.

 

Yes.

 

I must admit, I thought Apple tested apps automatically too. Plus, how hard is it to stick an app behind a proxy in a VM or container or whatever and monitor what traffic it sends and receives?

 

Is there a media blackout on this or something? Considering so many people have been compromised I thought it might have been covered a bit more.

 

It's covered heavily in China but not elsewhere. Mostly affects China though bunch of Chinese apps the Chinese what's app for example. It's also been sorted at last check.

 

"Interestingly, a Snowden leak from the CIA’s internal wiki system suggested that the agency had considered using a modified version of Xcode as an attack vector."

I'd be surprised if this was the only hack.

 

Every computer system in the world is suspect to attack. Despite marketing or anything else you really think a mass produced smartphone is going to be virus proof. CIA well less said. look at psn or Xbox live servers was not even a virus just DnS attacks that brought them down.

Skype was said to be a similar thing.

 

Yes every computer system in the world is suspect to attack but isn't creating a system with a single point of failure asking for trouble?

In a distributed system you may be able to compromise a few hundred or thousand individual systems, when you have a single point of failure you only have to attack that single point to compromise everything, a chains only as strong as its weakest link.

 

Redundancy is only good when it can mitigates a failure of another component. When we think of RAID (above 0) a failure in one disk can be compensated for by the remaining disks.

Increasing the number of gardens, walled or otherwise in terms of dev tools simply increases the surface area exposed to attack vectors. It doesn't reduce your problem it increases it. If there is a failure in one, having more of them doesn't help the matter. Unlike disks in RAID.

I'm almost universally opposed to Apple's approach to technology, but in this case having one controlled system is likely to be the most secure approach outside of opening the source.

 

I was thinking it was more like the Internet, sure you can take down parts that may effect small sections but you can't (well shouldn't be able to) target a single point and take the whole lot down or large swaths of it.

EDIT: I guess it comes down to how we/me/you view as the best approach to securing a system, yes a distributed system increases the surface area exposed to attack but it also lessens the inevitable impact of such an attack.

IMHO a failure, attack or problem is unavoidable, no system is 100% secure, it's just a matter of whether a one in a million chance that a problem could bring down an entire system is worth many small problems.

 

Ah you are referring to the download sites rather than the actual tools?

 

Well both if the download site (app store) only allows apps to be published written using a single tool, they both open up the possibility to target a single vector and effect the whole system, this particular attack was only limited in effect due to geographical/language reasons (afaik).

 

Multiple stores would be multiple points of attack and verification increased 10 fold