fokiciti.blogg.se

1. #CYDIA APP DOWNLOADER 2014 INSTALL#
2. #CYDIA APP DOWNLOADER 2014 CODE#
3. #CYDIA APP DOWNLOADER 2014 PC#
4. #CYDIA APP DOWNLOADER 2014 DOWNLOAD#

#CYDIA APP DOWNLOADER 2014 CODE#

Then, the hooking code will connect with another server 106.187.38.163, and send the stolen ID, GUID and password to it ( Figure 6). Through this way, u2_80 can steal a victim’s Apple ID, GUID and password. u2_80 searches for specific strings in all HTTP/HTTPS requests' bodyĮvery time the hooking code finds one of the strings, it will parse the adjacent field, reading values of the appleId, guid and password in the session data. The code uses a customized algorithm to encrypt these three strings in the binary, but we decrypted them during our analysis and they are shown in the following screenshots.įigure 5. It uses this hook to capture every HTTP or HTTPS request made by the phone and inspect the traffic for three strings in the body ( Figure 5): After being loaded, it will hook the (void)connectionDidFinishLoading:(id)arg1 method of the ISURLOperation class ( Figure 4). The code in u1_80 simply copies u2_80 into /Library/MobileSubstrate/DynamicLibraries/aid.dylib ( Figure 3), thus the u2_80 will be loaded by the Cydia Substrate framework later.

#CYDIA APP DOWNLOADER 2014 DOWNLOAD#

The server returns u1_80 and u2_80 as results, then download respective files from: Second Execution: Steal Apple ID and PasswordĪfter the UUID is generated, the second execution of updatesrv accesses the URL with the UUID value:

The u2 file simply contains the character “1”, but this is not used by the code. The code in u1’s is quite simple, it generates a new UUID by combining the current time, a random number between 0 to 9999 and current process ID, and stores it into /etc/uuid. Updatesrv will then download two files named u1 and u2 using the following URLs: If not then the second URL will have no UUID value: Main execution logic of the updatesrv First Execution: Generate UUIDĭuring the first execution, the updatesrv will determine if /etc/uuid exists. Let’s look at each of those three executions.įigure 2. If so, it will exit immediately otherwise, it will download two files from the server, rename them as /tmp/u1 and /tmp/u2, then execute the first one, and lastly delete all of the files.ĭuring the course of our analysis, we found that after updatesrv executes three times, the server will always return IDLE. The updatesrv will then determine whether the server returns “IDLE”. Then it reads the UUID from this file and constructs the second URL:

To fetch configuration of local UUID file path: /etc/uuid. Main execution logic of the updatesrv is shown in Figure 2. The updatesrv is configured as being launched every 2 hours The is a launchd daemon configuration file which specified that every 7,200 seconds (or 2 hours) the /bin/updatesrv will be loaded and run ( Figure 1).įigure 1.

#CYDIA APP DOWNLOADER 2014 PC#

There’re some possibilities that include through malicious Cydia Substrate tweak (like ) hosted in third-party Cydia sources, through other PC malware, through a PC jailbreaking utility, or possibly some other unknown ways.Īfter these devices were infected, the following files will be present in the file system: We still don’t know how the AppBuyer malware was installed onto jailbroken iOS devices. The team did some deeper analysis on the samples to disclose its mechanisms and provide solutions and suggestions to defeat it. On the other side, the sample’s C&C servers are still alive currently, which may impact more users.

#CYDIA APP DOWNLOADER 2014 INSTALL#

However, the WeiPhone Technical Group didn’t explain how the samples install other apps into infected devices. In the same day, being noticed by this group, we posted a quick introduction to this new threat in the mobile.malware Google group with a temporary name “Updatesrv”. They also provided these samples for downloading. Lastly, they tried to identify the attacker through analyzing the C&C server’s domain name through the samples used. They found that these files would download, execute and delete other executable files from the Internet. They remotely assisted a user to find out why some apps periodically had been installed onto his jailbroken iPhone, and finally located two strange files on that device. The AppBuyer was first mentioned by four members of the WeiPhone Technical Group at May 18th, 2014. The malware will connect to C&C server, download and execute malicious executable files, hook network APIs to steal user’s Apple ID and password and upload to the attacker’s server, and simulate Apple’s proprietary protocols to buy apps from the official App Store by victim’s identity. Palo Alto Networks recently found and analyzed a new iOS malware affecting jailbroken iOS devices in the wild.