HACKINTOSH.ORG | Macintosh discussion forums

How a mobile app company found Apple's XcodeGhost in the machine

<article>
   <section class="page">
<p>Nick Arnott couldn’t figure out recently why Apple kept rejecting an update to a mobile app his company developed.</p><p>It turned out the problem was a ghost in the machine.</p><p>His company, Possible Mobile (https://possiblemobile.com/), is well versed in the App Store submission rules and has built apps for JetBlue, Better Homes &amp; Gardens and the Major League Soccer.</p><p>The rejection came after it was discovered in mid-September that thousands of apps in the App Store had been built with a counterfeit version of an Apple development tool, Xcode (https://developer.apple.com/xcode/).</p><p>The fake version, dubbed XcodeGhost (http://researchcenter.paloaltonetworks.com/2015/09/malware-xcodeghost-infects-39-ios-apps-including-wechat-affecting-hundreds-of-millions-of-users/) and probably developed in China, had been downloaded by many developers from third-party sources, apparently because getting the 4GB code from Apple took too long.</p><p class="jumpTag"><a href="/article/3002337/business-security/how-a-mobile-app-company-found-the-xcodeghost-in-the-machine.html#jump">To read this article in full or to leave a comment, please click here[/url]</p></section></article>

Source: How a mobile app company found Apple's XcodeGhost in the machine (http://www.macworld.com/article/3002337/business-security/how-a-mobile-app-company-found-the-xcodeghost-in-the-machine.html#tk.rss_all)