This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. > Find out more here
by Gareth Morgan
21 Feb 2013
Developer site iPhoneDevSDK has admitted it may have been the source of malware that allowed attackers to compromise tech firms including Apple, Facebook and Twitter.
Attackers were able to compromise an administrator account for the website, which is hugely popular with iPhone developers, and covertly distribute an exploit which targeted zero-day vulnerabilities in Adobe Flash and Java plugins.
“The hackers used this account to modify our theme and inject JavaScript into our site. That JavaScript appears to have used a sophisticated, previously unknown exploit to hack into certain user's computers,” wrote iPhoneDevSDK administrator Ian Sefferman.
“We're very sorry for the inconvenience - we'll work tirelessly to ensure your data's security now and in the future,” he added.
The attacks show a high degree of planning and skill, using previously unknown vulnerabilities and targeting high-value users, noted Sean Sullivan, a security researcher at F-Secure.
As Macs typically account for about 15 percent of internet users, making them too small a target to attract the attention of most hackers, Sullivan wrote on the F-Secure blog.
"But in the 'developer world', Macs have a much higher percentage of market share. In Silicon Valley we'd guesstimate it's probably the inverse of the real-world: 85 percent," he wrote.
"As such, there is relatively high motivation for bad guys to develop 'sophisticated' attacks that incorporate Mac-based payloads."
Apple, Facebook and Twitter have all subsequently confirmed that a handful of their staff had their laptops compromised, suggesting the attackers' tactics paid off. All three have claimed no personal data had been put at risk.
The attacks also raise questions about Apple's patching policy, and how much Apple knew about the potential risks before the attacks took place, said F-Secure's Sullivan.
“Apple began removing old versions of Java from Macs when people updated OS X in October 2012. Was that a proactive or reactive decision? How many times has Apple been compromised?” he asked.
Apple had not immediately responded to V3's request for comment on Sullivan's concerns.
Latest stories from Security
Related articles
Related jobs
Poll
Which productivity tools do you use for work?
V3 pits Sony's rugged flagship against Apple's premier handset
Updating your subscription status
Connect with V3.co.uk
It's no longer one or other with web security; you can now have a virtualisation and SaaS hybrid model
BYOD is important for employee satisfaction, but poses challenges in terms of security, productivity loss and costs
Client Account Manager £120K ote (£60 base) + excellent...
Front End Developer - £33k-£40k Are you a Front End...
Senior Designer - £45k-£55k Do you feel restricted...
UX Designer - £33k-£40k Are you passionate about User...
Keep up to date with the latest products, services and technologies from the world's leading IT companies. IThound.com brings you over 2,000 white papers, case studies and analyst reports.
Do you agree