A sales assistant shows features of iOS 9 on an Apple iMac at an Apple reseller shop in Bangkok September 18, 2015. 
 
 BOSTON Apple Inc APPL.O said on Sunday it is cleaning up its iOS App Store to remove malicious iPhone and iPad programs identified in the first large-scale attack on the popular mobile software outlet. 
 
 The company disclosed the effort after several cyber security firms reported finding a malicious program dubbed XcodeGhost that was embedded in hundreds of legitimate apps. 
 
 It is the first reported case of large numbers of malicious software programs making their way past Apple's stringent app review process. Prior to this attack, a total of just five malicious apps had ever been found in the App Store, according to cyber security firm Palo Alto Networks Inc (PANW.N). 
 
 The hackers embedded the malicious code in these apps by convincing developers of legitimate software to use a tainted, counterfeit version of Apple's software for creating iOS and Mac apps, which is known as Xcode, Apple said. 
 
 "We’ve removed the apps from the App Store that we know have been created with this counterfeit software," Apple spokeswoman Christine Monaghan said in an email. "We are working with the developers to make sure they’re using the proper version of Xcode to rebuild their apps." 
 
 She did not say what steps iPhone and iPad users could take to determine whether their devices were infected. 
 
 Palo Alto Networks Director of Threat Intelligence Ryan Olson said the malware had limited functionality and his firm had uncovered no examples of data theft or other harm as a result of the attack. 
 
 Still, he said it was "a pretty big deal" because it showed that the App Store could be compromised if hackers infected machines of software developers writing legitimate apps. Other attackers may copy that approach, which is hard to defend against, he said. 
 
 "Developers are now a huge target," he said. 
 
 Researchers said infected apps included Tencent Holdings Ltd’s (0700.HK) popular mobile chat app WeChat, car-hailing app Didi Kuaidi and a music app from Internet portal NetEase Inc. 
 
 The tainted version of Xcode was downloaded from a server in China that developers may have used because it allowed for faster downloads than using Apple's U.S. servers, Olson said. 
 
 Chinese security firm Qihoo360 Technology Co (QIHU.N) said on its blog that it had uncovered 344 apps tainted with XcodeGhost. 
 
 Apple declined to say how many apps it had uncovered. 
 
 (Reporting by Jim Finkle; Additional reporting by Scott DiSavino in New York; Editing by Chizu Nomiyama and Eric Beech) 

 Apple has removed malware-infected apps from the App Store after acknowledging its first sustained security breach. The malware, known as XcodeGhost, worked its way into several apps by convincing developers to use a modified version of Xcode, the software used to create iOS and Mac software. 
 
 "We've removed the apps from the App Store that we know have been created with this counterfeit software," Apple spokesperson Christine Monaghan told Reuters. "We are working with the developers to make sure they're using the proper version of Xcode to rebuild their apps." 
 
 XcodeGhost could be "very harmful and dangerous." 
 
 Among the more notable apps affected were dominant Chinese messaging app WeChat, popular business card scanner CamCard, and Chinese Uber rival Didi Chuxing. WeChat, which has over 600 million monthly active users, said in a blog post that the exploit only affected a prior version of the app released on September 10th; the present version, released two days later, is clean. 
 
 Security firm Palo Alto Networks investigated XcodeGhost and concluded that it was able to prompt fake phishing dialogs, open URLs, and read and write clipboard data, leading the company to call it a "very harmful and dangerous" piece of malware that has affected at least 39 apps. 
 
 There's no evidence that any data theft has occurred yet, but XcodeGhost is worrying because it shows how legitimate developers can be used as a vector for malicious software, bypassing Apple's code review — a method that the CIA has also considered deploying. Palo Alto's Ryan Olson told Reuters that the compromised version of Xcode came from a server in China, and may have been used because it was faster to download than the free, official version on Apple's App Store. 
 
 Verge Video: iOS 9 review 

 On Thursday we posted the initial analysis report on XcodeGhost malware and then found it had infected 39 iOS apps, potentially impacting hundreds of millions of users. XcodeGhost embedded malicious code into those infected iOS apps. In the first report, we noted that the malicious code uploads device information and app information to its command and control (C2) server. But that isn’t all it does. 
 
 Today, inspired by a post by “@Saic” on Sina Weibo, we analyzed the malicious code in more detail and found additional capabilities in the malware. In summary, the malicious code that XcodeGhost embedded into infected iOS apps is capable of receiving commands from the attacker through the C2 server to perform the following actions: 
 
 Prompt a fake alert dialog to phish user credentials; 
 
 Hijack opening specific URLs based on their scheme, which could allow for exploitation of vulnerabilities in the iOS system or other iOS apps; 
 
 Read and write data in the user’s clipboard, which could be used to read the user’s password if that password is copied from a password management tool. 
 
 (UPDATE September 21: In the current version of the code, XcodeGhost cannot be directly used to phish iCloud passwords. However, by changing a few simple lines of code, it can do that.) 
 
 Based on this information, we believe XcodeGhost is a very harmful and dangerous malware that has bypassed Apple’s code review and made unprecedented attacks on the iOS ecosystem. The techniques used in this attack could be adopted by criminal and espionage focused groups to gain access to iOS devices. 
 
 Technical Details 
 
 XcodeGhost added code to some system APIs that are used by the infected apps. After the malware sends device and app information to it’s C2 servers, XcodeGhost will decrypt the content returned by the server and parse it as a piece of JSON formatted data. 
 
 Figure 1. XcodeGhost decrypts response JSON data 
 
 In the JSON data, XcodeGhost will look for these keys: 
 
 alertHeader 
 
 alertBody 
 
 appID 
 
 cancelTitle 
 
 confirmTitle 
 
 The malware uses the specified title and body texts to create a fake alert dialogue box.. Using this technique, XcodeGhost can be used to “phish” information from the user, or trick them into inputting sensitive data. For example, it can create a dialog that asks the victim to input their password. Since the dialog is a prompt from the running application, the victim may trust it and input a password without suspecting foul play. 
 
 Figure 2. XcodeGhost prompts a alert dialog with specific title and message text 
 
 If the returned JSON data from the server contains the key “url”, XcodeGhost will open the URL specified. 
 
 Figure 3. XcodeGhost opens remotely specified URL 
 
 Note that the specified URL doesn’t have to be only HTTP or FTP URLs but also the URLs used by iOS system with any scheme that local system can handle. (i.e. itunes:// or twitter://) The URL scheme is one of the main Inter-App Communication mechanisms in iOS system. Any iOS apps, include system apps, can define any scheme it can handle. Multiple previous vulnerabilities in iOS and various iOS apps have been caused by scheme handling flaws that can be exploited by opening specific URLs. These vulnerabilities must be exploited locally by a malicious app, which led many people to not treat them as serious as iOS malware is uncommon. XcodeGhost has broken this assumption by infecting many popular iOS apps that are widely used. 
 
 Finally, XcodeGhost will also use the clipboard functionality provided by iOS to temporarily store some data it needs. In fact, every time an infected app is launched, XcodeGhost will retrieve persistently stored data from the clipboard with a paste board named by app’s bundle ID and a fixed string “UIPasteBoard”, then store new data inside it. Although this behavior is not harmful to users, a slightly code change would allow the same technique to steal passwords from password management apps such as 1Password. 
 
 When people use apps like 1Password to manage their passwords in iOS, they often open 1Password, copy the stored password to system clipboard, then open the app they want to use and paste the password to the login window. At this moment, a malicious app can directly read the password from system clipboard. 1Password’s main security design for this situation is that, the password stored in the clipboard will only stay there for a very short time. However, since the malware can read it when the app launches, the attack can be successful. 
 
 Attack in the Wild 
 
 Earlier today on a popular Chinese forum V2EX, a user “realpg” mentioned his experience when developing iOS apps using the malicious Xcode package. His write-up disclosed that XcodeGhost’s attacker has used the malware to phish victims’ iCloud passwords. 
 
 In the discussion, “realpg” said that when they were developing a very simple iOS app that had no Internet functionality and didn’t use any iCloud APIs, the app would frequently display a dialog to ask the developer to input his iCloud password. They tested the app in their special testing iPhone without jailbreak. Then they tried to capture the network traffic and found the exactly the same C2 domain name used by XcodeGhost infected apps. 
 
 Based on “realpg”’s account of the events, we believe that stealing passwords or potentially exploiting vulnerabilities in iOS and in legitimate applications may be the true purpose of XcodeGhost. 
 
 Acknowledgement 
 
 Thanks to Luyi Xing from Indiana University for providing knowledge about password management tools. Also, many thanks to @Saic on Sina Weibo for identifying potential behaviors in XcodeGhost. 

 Apple has taken down several apps after hundreds were found to have been compromised by a major attack on the App Store. 
 
 In the first significant security issue to affect the usually-watertight App Store for the iPhone and iPad, many were found with malicious "XcodeGhost" code inside of them. 
 
 The code found its way into the apps because developers had been tricked into using a modified version of Apple's official software for creating apps, known as Xcode. The code was deeply embedded in the apps, which made it through the Apple reviewers who check every app before they are made available to download. 
 
 Security firm Palo Alto Networks said the XcodeGhost code could have reached hundreds of millions of users and taken data such as passwords, although it had not seen any examples of sensitive information being stolen. It said only five App Store apps had previously been found to be malicious. 
 
 The malicious software was hosted on Chinese website Baidu, and thus is believed to largely affect apps in China. Some developers download Xcode from unofficial sources in China because it can reportedly take a long time to get it from Apple's servers. 
 
 Photo: WeChat 
 
 Tencent, the owner of the popular Chinese social network WeChat, said that a preliminary investigation had found no evidence of data being leaked or stolen, and that its most up-to-date version of the WeChat app was not affected. 
 
 However, apps that are available outside of China can also be affected. CamCard, which scans business cards and imports them into a phone's contacts, is said to have been affected, while WeChat is used around the world, not just in China. Several other scanner apps are among a list of affected software. 
 
 Qihoo 360, a Chinese security firm, said it had found 344 apps affected by Xcode Ghost. 
 
 "We've removed the apps from the App Store that we know have been created with this counterfeit software," Apple said. 
 
 "We are working with the developers to make sure they're using the proper version of Xcode to rebuild their apps." 
 
 Earlier this month, it emerged that 225,000 iPhone users who had "jailbroken" their iPhones may have had their data stolen by hackers. However, the XcodeGhost code could affect both jailbroken and "stock" devices. 
 
 Users who believe they may have been affected should remove any apps that may have been affected, as well as resetting their iCloud software and those associated with any of the affected apps.
– Apple has suffered its first major attack on the App Store and yesterday confirmed that it had removed the offending apps. Apple says hackers modified the tool, called Xcode, that developers use to create iOS apps. Developers who mistakenly used the counterfeit XcodeGhost created apps that had the malicious code in them. Among the affected apps, per the Verge: ride-hailing app Didi Kuaidi and messaging app WeChat, both popular in China. Before the breach, just five App Store apps had ever been considered malicious, reports Reuters. By security firm Palo Alto Networks' initial count, at least 39 apps had been infected, though Chinese security company Qihoo says it has found more than 300 infected apps, per the Telegraph. "To protect our customers, we've removed the apps from the App Store that we know have been created with this counterfeit software," an Apple rep says. The New York Times explains that after download, the infected apps' code could trigger certain websites to open that subsequently further infect the phone; the code can also force pop-ups that request things like passwords. Reuters notes developers may have used the bad version of Xcode because it was held on a Chinese server and could possibly be downloaded faster than Apple's version on US servers. The Verge's take: "XcodeGhost is worrying because it shows how legitimate developers can be used as a vector for malicious software, bypassing Apple's code review."