4 ms·
> The infections were the result of legitimate developers writing apps using a counterfeit copy of Xcode, Apple’s iOS and OS X app development tool. The repacka
by RcouF1uZ4gsC 6y ago
> The infections were the result of legitimate developers writing apps using a counterfeit copy of Xcode, Apple’s iOS and OS X app development tool. The repackaged tool dubbed XcodeGhost surreptitiously inserted malicious code alongside normal app functions.
> XcodeGhost billed itself as faster to download in China, compared with Xcode available from Apple. For developers to have run the counterfeit version, they would have had to click through a warning delivered by Gatekeeper, the macOS security feature that requires apps to be digitally signed by a known developer.
Seems like a real world version of the Trusting Trust attack where the compiler is inserting malicious code.
- smbv 6y agoMaybe it's time to reread Reflections on Trusting Trust[0] [0] https://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-tho...
- medstrom 6y agoThe full Trusting Trust attack would be if you'd use XcodeGhost to compile Xcode and it actually makes another XcodeGhost that just looks like Xcode, right? Preferably you do this to the developer responsible for uploading the compiled Xcode to central download servers. After a while no one has the real Xcode anymore, it's been lost to time, but no one knows this.