THE US GOVERNMENT has issues a security warning to iOS users, advising that they should beware of a major security flaw called Masque Attack that could allow attackers to steal sensitive information from iPhones and iPads'
The US Computer Emergency Readiness Team (US-CERT) sent out a bulletin recommending that iOS users stick to trusted application download sites and trusted computers.
It also reminded users to look out for pop-up warnings saying that apps may be untrusted, and suggested that they resist installing them.
US CERT warned: "Don't install apps from sources other than Apple's official App Store or your own organisation; don't click 'Install' from a third-party pop-up when viewing a web page; when opening an app, if iOS shows an 'Untrusted App Developer' alert, click on 'Don't Trust' and uninstall the app immediately."
FireEye originally warned about Masque earlier this week, stating that the malware exploits a flaw in the iOS 7.1.1, 7.1.2, 8.0, 8.1 and 8.1.1 beta enterprise provisioning features, hacking app caches by masquerading as legitimate apps and making about 95 percent of devices vulnerable.
"Masque Attacks can replace authentic apps, such as banking and email apps, using the attacker's malware through the internet," said FireEye in a blog post about the Masque campaign.
"That means the attacker can steal a user's banking credentials by replacing an authentic banking app with malware that has an identical UI."
FireEye said it originally spotted the flaw this summer, and blamed a ‘bundle identifier' issue.
"In July 2014, FireEye mobile security researchers discovered that an iOS app installed using enterprise/ad hoc provisioning could replace another genuine app installed through the App Store, as long as both apps used the same bundle identifier," it said.
"All apps can be replaced except iOS pre-installed apps, such as Mobile Safari. This vulnerability exists because iOS doesn't enforce matching certificates for apps with the same bundle identifier. An attacker can leverage this vulnerability through wireless networks and USB."
Apple responded to the Masque Attack reports in a statement, saying that it designed OS X and iOS with built-in security safeguards to protect customers and warn them before installing potentially malicious software.
Apple added that it is "not aware of any customers that have actually been affected by this attack". µ
Fox? Roadrunner more like
Sharkstooth CPU promises some bite
But there's no Play Store access or Google services
Less than sound proposition