XcodeGhost, one of my favorites for iOS, simply because this
burst the bubble of Apple users who thought we were all safe.
I have so many friends that think
because they have a Mac or an iPhone,
they can never get Malware.
And that's not the case.
Now, here is the scary thing about XcodeGhost.
Apple is really specific on the version of Xcode
that developers can use to create applications.
The version of Xcode that Apple released
to all of the developers worldwide creating apps
was already infected by the Chinese.
This version was used for native applications,
regular applications-- things like banking,
chat applications, were then already infected,
went through the Apple process, were approved,
were posted on the App Store because they used
the approved version of Xcode.
When Apple realized that the version of Xcode that
was being used for development, all of those apps
were removed from the App Store.
Now here is the concern.
What if that app is already on someone's device?
What if they aren't using it anymore,
so it's not going out and updating from the App Store?
This version of Malware, XcodeGhost,
gives full command and control to non-jailbroken iOS devices.
It was kind of the breakthrough that rocked us
when people were like, whoo, maybe I'm
not so safe on an Apple product.
The most impact was in China and North America.
WeChat, which is a common chat application used in China--
everyone in China has WeChat.
It was a huge impact in WeChat.
So if you have a device that you're examining,
and you think it could be a victim of XcodeGhost,
just Google XcodeGhost, see what the versions
are, and see what versions of apps
are installed on your device.