{"id":140900,"date":"2015-10-06T08:25:31","date_gmt":"2015-10-06T06:25:31","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=140900"},"modified":"2015-10-06T08:29:52","modified_gmt":"2015-10-06T06:29:52","slug":"new-malware-attacks-all-iphones-and-ipads","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/140900-new-malware-attacks-all-iphones-and-ipads.html","title":{"rendered":"New malware attacks all iPhones and iPads"},"content":{"rendered":"

Palo Alto Networks<\/strong><\/a>\u00a0recently identified a new Apple iOS malware called\u00a0YiSpecter.<\/p>\n

YiSpecter attacks both jailbroken and non-jailbroken iOS devices through unique and harmful malicious behaviours.<\/p>\n

\u201cSpecifically, it\u2019s the first malware we\u2019ve seen in the wild that abuses private APIs in the iOS system to implement malicious functionalities,\u201d said Palo Alto Networks.<\/p>\n

The malware primarily affected iOS users in China and Taiwan. It spreads via unusual means, including the hijacking of traffic from nationwide ISPs, an SNS worm on Windows, and an offline app installation and community promotion.<\/p>\n

YiSpecter consists of four components that are signed with enterprise certificates.<\/p>\n

By abusing private APIs, these components download and install each other from a command and control (C2) server.<\/p>\n

Three of the malicious components use tricks to hide their icons from iOS\u2019s SpringBoard, which prevents the user from finding and deleting them.<\/p>\n

The components also use the same name and logos of system apps to trick iOS power users.<\/p>\n

On infected iOS devices, YiSpecter can do the following:<\/p>\n