A new report has alleged that more than 220,000 iCloud accounts have potentially been compromised by malicious jailbreak tweaks masquerading themselves as trustworthy installations. Those who are regularly involved in the world of jailbreaking may want to pay particularly close attention, as it seems that a number of extensions and tweaks use sophisticated attack measures to acquire very specific information from the jailbroken host device.
This worrying piece of information comes in from a Chinese security website WooYun. The report is unable to provide any intricate information on the individual or team of individuals that is likely behind this extraction of data, nor is it able to actually name and shame the packages that have been responsible for stealing the information. It is however confident that malicious developers are using sophisticated “built-in backdoors” in a number of tweaks with the sole intention of nabbing and remotely storing the iCloud credentials associated with a particular device. Of course, having this data potentially allows attackers to view iMessages, contacts and much more.
One of the biggest concerns about jailbreaking an iOS device amongst the security conscious has always been whether or not to liberate the device from Apple’s walled garden, which compromises the security of the device. Some corners – generally those interested in jailbreaking and customization – argue that jailbreaking makes the device more secure as the vulnerability used to get root access is then patched as part of the process. But then there are also some who are less enthusiastic about the topic.
Reddit user ZippyDan claims that the majority of Chinese market traders sell and distribute iPhones and iOS devices that are pre-jailbroken for the consumers convenience. There’s a high probability that a number of these devices have already been loaded with tweaks designed with malicious intent, much to the detriment of the unsuspecting individuals who purchases them. And they’re likely to be the ones affected in this particular.
In any case, without knowing exact details and tweaks which could be problematic, the best thing jailbroken users can do right now is to stay away from tweaks and apps that come from untrusted, unknown repositories. More importantly, if you do not have two-step authentication enabled for your Apple ID, you should do so now by following our guide here: How To Enable Two-Step Verification For Apple ID / iTunes / iCloud.
You can follow us on Twitter, add us to your circle on Google+ or like our Facebook page to keep yourself updated on all the latest from Microsoft, Google, Apple and the web.