New iOS malware highlights threat to Apple mobile devices

A newly-discovered malware dubbed  Unflod Baby Panda is stealing Apple ID credentials from jailbroken iPhones and iPads, warn security researchers.

Download this free guide

Computer Weekly's Buyer's Guide to GDPR Part 2

In this 12-page buyer’s guide, we look at the tools that could be used for compliance, the incentive to create a smarter, leaner business, and the myths surrounding the new rules.

Start Download

• Corporate E-mail Address:

  You forgot to provide an Email Address.

  This email address doesn’t appear to be valid.

  This email address is already registered. Please login.

  You have exceeded the maximum character limit.

  Please provide a Corporate E-mail Address.

By submitting my Email address I confirm that I have read and accepted the Terms of Use and Declaration of Consent.

By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

Unflod hooks into the SSLWrite function of an infected device's security framework, according to a blog post by German security firm SektionEins.

The malware is designed to listen for outgoing connections. Once it recognises an Apple ID and password, it sends these unencrypted IDs and passwords to the cyber criminals behind the malware.

The Unflod malware also highlights the risks of installing unknown apps on jailbroken iPhones.

Reports of the malware targeting Apple iOS emerged in posts on reddit by iOS users hit by repeated system crashes after installing iOS customisations that were not part of the official Cydia market.

A developer for the Cydia market, an alternative to the Apple App Store, has responded to news by in a reddit comment, saying that the probability of Unflod coming from a default Cydia repository is fairly low.

However, he added: "I don't recommend people go adding random URLs to Cydia and downloading random software from untrusted people any more than I recommend opening the .exe files you receive by email on your desktop computer".

The origin and source of the malware is still unknown, which means no one can yet say which software package from what unofficial repository is likely to initiate an infection, according to security firm Sophos.

The infected file relies on add-on functionality, commonly available on jailbroken devices, known as Cydia Substrate or Mobile Substrate, the firm’s Paul Ducklin wrote in a blog post.

This "substrate" allows users to extend and modify the behaviour of iOS in ways that are deliberately prohibited by Apple on devices that have not been jailbroken.

However, Ducklin said the threat is limited because the malware can affect only jailbroken devices and SophosLabs has not had any report of “in the wild” infections.

“If you haven't jailbroken your iOS device, you don't need to worry.

“If you are a jailbreaker and you have been circumspect in what you choose to install, you probably don't need to worry,” Ducklin wrote.

The malicious code only works only on 32-bit versions of jailbroken iOS devices, according to SektionEins.

There is no ARM 64-bit version of the code, which means the malware should never be successful on the iPhone 5S, iPad Air or iPad mini 2G, the firm told ArsTechnica.

SektionEins recommends that anyone affected by the malware should restore the device and change their Apple ID and password as soon as possible.