Malware steals 225,000 Apple accounts on jailbroken devices

A large amount of Apple accounts on jailbroken iOS devices appear to have been compromised by a new malware dubbed KeyRaider.

KeyRaider in ransomware mode. Source: WeipTech/Palo Alto Networks.

Security vendor Palo Alto Networks together with Chinese company We iPhone Tech Team (WeipTech) said they had collected 92 samples of the iOS malware in the wild.

KeyRaider is distributed mainly via Chinese Cydia third-party iOS repositories of software not authorised by Apple, the researchers said.

While Chinese iOS jailbreakers have been hit by KeyRaider, Palo Alto networks noted that the malware has struck users in 18 other countries, Australia included.

The malware steals users' Apple account details - WeipTech discovered over 225,000 valid logins on a server after analysing what it said were suspicious iOS tweaks.

Apart from the valid Apple accounts, KeyRaider is said to have grabbed thousands of digital certificates, private encryption keys and software purchase receipts and uploaded them to command and control servers in China. 

The researchers said the malware was devised to make it possible for users of two iOS jailbreak tweaks to download software and content from the official Apple App Store - without paying for them.

KeyRaider goes beyond fraudulently obtaining apps through stolen user credentials, however. Palo Alto noted that with Apple account credentials captured, attackers are able to control devices through the iCloud service as well as obtain their private data.

Some users reported that their devices were locked and held to ransom, although the researchers did not say how much money the blackmailers demanded to unlock them.

Apart from changing Apple account passwords and enabling two-factor authentication, the researchers said users of jailbroken devices can install an OpenSSH server and connect to them using a command line terminal and grep (search) for the following strings in the /Library/MobileSubstrate/DynamicLibraries directory:

• wushidou
• gotoip4
• bamu
• getHanzi

If any of the dynamic library files in the directory contain the above strings, researchers suggested users delete them. Users are also advised to delete any plist files with the same name as the malicious dynamic library files, and reboot their devices.

The best precaution to avoid infection by KeyRaider and similar malware is not to jailbreak iPhones and iPads, the researchers said. Cydia repositories do not perform strict software security checks, they added, and warned they be used at users' own risk