iOS and OS X Security Flaws Enable Malicious Apps to Steal Passwords and Other Data

iOS and OS X Security Flaws Enable Malicious Apps to Steal Passwords and Other Data

A team of six researchers from Indiana University, Georgia Tech and Peking University have published an in-depth report exposing a series of security vulnerabilities that enable sandboxed malicious apps, approved on the App Store, to gain unauthorized access to sensitive data stored in other apps, including iCloud passwords and authentication tokens, Google Chrome saved web passwords and more.

<center><iframe width="640" height="360" src="https://www.youtube.com/embed/IYZkAIIzsIo?rel=0" frameborder="0" allowfullscreen></iframe></center>
The thirteen-page research paper "Unauthorized Cross-App Resource Access on Mac OS X and iOS" details that inter-app interaction services, ranging from the Keychain and WebSocket on OS X to the URL Scheme on OS X and iOS, can be exploited to steal confidential information and passwords, including those stored in popular password vaults such as 1Password by AgileBits.

"We completely cracked the keychain service - used to store passwords and other credentials for different Apple apps - and sandbox containers on OS X, and also identified new weaknesses within the inter-app communication mechanisms on OS X and iOS which can be used to steal confidential data from Evernote, Facebook and other high-profile apps."

The different cross-app and communication mechanism vulnerabilities discovered on iOS and OS X, identified as XARA weaknesses, include Keychain password stealing, IPC interception, scheme hijacking and container cracking. The affected apps and services include iCloud, Gmail, Google Drive, Facebook, Twitter, Chrome, 1Password, Evernote, Pushbullet, Dropbox, Instagram, WhatsApp, Pinterest, Dashlane, AnyDo, Pocket and several others.

<center><iframe width="640" height="360" src="https://www.youtube.com/embed/7NGlmWtw83s?rel=0" frameborder="0" allowfullscreen></iframe></center>
Lead researcher Luyi Xing told The Register that he reported the security flaws to Apple in October 2014 and complied with the iPhone maker's request to withhold publishing the information for six months, but has not heard back from the company since and is now exposing the zero-day vulnerabilities to the public. The flaws affect thousands of OS X apps and hundreds of iOS apps and can now be weaponized by attackers.

Recent Mac and iOS Blog Stories
• Apple Yet to Contact Indie Publishers for Apple Music Streaming Rights
• Review: Customize Your Apple Watch's Digital Crown and Side Button With WatchDots
• Twitter Brings Autoplay Video, Vines, and GIFs to iOS and Web
• Apple Discussed Delivery Deal With Uber Before Postmates Agreement
• iPhone Photography Awards Showcase Best Photos of 2015
• Bethesda Releases 'Fallout Shelter' for iOS
• Ahead of 'iPhone 6s' Debut, a Look at Feld & Volk, the Biggest Source of iPhone 6 Leaks
• Hands-On With iOS 9's New iPad Multitasking Feature
<img width='1' height='1' src='