The trusted world's leading mobile operating system iOS has chinks in it's armour. It was reported earlier in late november on the iOS Masque attack which included replacing a legit application already on the phone with a malicious one through SMSs, mail & web and stealing the sensitive information including logins of user's account.

The researchers at FireEye have found that the new set of iOS Masque Attack have become more refined which makes them more volatile than the previous edition. This time these attacks are bypassing the iOS prompt notification for trust with iOS URL scheme hijacking being carried under the current iOS update.

The iOS URL scheme is, at simplest level, a custom URL scheme allowing users to open your app from other apps. But the true power of URL schemes is in the ability to perform specific actions as your app opens. By taking undue advantage of using similar URL scheme of popular apps, these system of malicious apps replacing the existing one & stealing the user's personal information & login credentials is giving a nightmare to the users.

The modus operandi of the Masque Attack

The user gets a link to download a new app through a SMS, mail or web popups. The user can be part of the organization's signed app ecosystem where an app develeped for internal purposes can be downloaded without going through the app store with choosing a "trust" option on a notification asking for permission. The attacks are specifically designed to bypass this permission barrier. Even if the user outrightly rejects permission by choosing "Don't Trust" option in the notification, these enterprise-signed apps goes on the launch themselves. This bypass combined with similar URL scheme can entirely hijack an user's iphone. As soon as the user now tries to exit this app & launch another one, he'll be still redirected to the malware infected app. This gives the attackers access to the all the date on the user's iphone as well as expose the logins on all the installed apps.

 

URL scheme hijacking (Technical Details)

The script used to design apps on the iOS has various protocols to be followed & URL scheme is one of it. The attackers have exploited this vulnerability in the system to their full advantage by masking the milacious app's URL scheme same with one of the popular app's already existing in the user's phone. The most commonly targeted ones are the URL schemes of facebook & google mail.

"There are 28 App Store apps all registering the URL scheme fb://, which is one of the URL scheme registered by the Facebook app. 16 of these 28 apps are not from Facebook. At least 8048 App Store apps register the same URL scheme fb118493188254996 and many of these apps are from different developers", says the report from FirEye.

 

Conclusion

Apple had successfully managed to thwart the previous masque attacks but taking on URL scheme hijacking will not be a smooth ride. Apple treats it as a feature for different developers to use the same URL scheme rather than providing a unique one for every app to be able to run on the system.