Is Fake iMessage App Malware or Not?

For all the talk about hackers cracking Apple's Touch ID security, there's another Apple-related threat that should be on the smartphone world's radar screen. But this one comes with a twist.

And here's the twist: It's not Apple users who are at risk. It's Android users who think they are looking at an Apple app.

The app is called iMessage Chat and it's available for free from the Google Play Store. The app lets Android users chat with iOS users, much like BBM (BlackBerry Messenger) lets BlackBerry users chat with other platforms. But it reportedly reads your messages, installs malware on your device, and even steals your Apple passwords.

Accessing the Secret Sauce

Jay Freeman, an application developer best known for creating the Cydia app store for jailbroken iPhones, is sounding the alarm. He explained the way it works: The client directly connects to Apple, but the data is all processed on the developer's server in China.

"This not only means that Apple can't just block them by IP address, but also that they get to keep the 'secret sauce' on their servers (and potentially just run Apple code: there are some parts of the process in Apple's client code that is highly obfuscated)," he wrote on a Google+ post.

Freeman explained that every packet from Apple is forwarded to 222.77.191.206, which then sends back exactly what data to send to Apple, along with extra packets that he presumes tell the client what's happening so it can update its user interface. Likewise, he said, if the client wants to send a message, it first talks to the third-party server, which returns what needs to be sent to Apple. The data is re-encrypted as part of this process, he continued, but its size is deterministically unaffected.

"Clearly, this is suboptimal from a security perspective. Is this the...

Comments are closed.