It’s all about Apple this week.
Some very industrious, not to mention very naughty hackers deployed a dodgy version of the iOS development tooling, Xcode. Now nattily called XcodeGhost, it appears that it has been downloaded and used to build and successfully deploy infected versions of seemingly bona fide applications, which users may have been running for months or years.
More than 4000 applications have been infected according to the people at FireEye including some biggies like the WinZip application!
The top 25 infected applications can be found here.
Apple are doing sterling work in dealing with the issue on the AppStore, but we recommend that you keep abreast of this fast moving news story in case some of the applications your users might have are found to be compromised.
Should we hear of any significant apps being discovered infected we will release an emergency update to our customers and on this blog.
In other Apple news, a bug has been discovered in iOS version9 which enables the lock screen to be bypassed and data on the device accessed, even if you have Touch ID configured with fingerprint recognition.
Apple were made aware of this bug on 14 September, two days before the release of iOS9 and remains unfixed. The current workaround, which we recommend that you implement, until the issue is fixed, is to disable Siri on the lock screen:
Go to Settings | Touch ID & Passcode, and under Allow Access When Locked, toggle Siri off.
You may want to turn off everything under the Allow Access When Locked section, just to be on the safe side.
All in all a pretty bad week for Apple!
What both of these issues highlight is that the extraordinarily fast developing world of mobile is quite a risky world in which Mobile Device Management is essential but not necessarily fool proof.
ITC’s NetSure360° managed security service has the capability to identify potentially vulnerable mobile devices connected to your Enterprise resources and ensure they are better inspected or banned altogether.
If you would like to know any more about the issues in this article, or any security issue, please contact us on: 020 7517 3900 or email [email protected]
