Acting like a software version of a Transformer robot, a malware test app sneaked through Apple's review process disguised as a harmless app, and then re-assembled itself into an aggressive attacker even while running inside the iOS "sandbox" designed to isolate apps and data from each other.
The app, dubbed Jekyll, was helped by Apple's review process. The malware designers, a research team from Georgia Institute of Technology's Information Security Center (GTISC), were able to monitor their app during the review: they discovered Apple ran the app for only a few seconds, before ultimately approving it. That wasn't anywhere near long enough to discover Jekyll's deceitful nature.
The name is a reference to the 1886 novella by Robert Louis Stevenson, called "The Strange Case of Dr Jekyll and Mr Hyde." The story is about the two personalities within Dr. Henry Jekyll: one good, but the other, which manifests as Edward Hyde, deeply evil.
Jekyll's design involves more than simply hiding the offending code under legitimate behaviors. Jekyll was designed to later re-arrange its components to create new functions that couldn't have been detected by the app review. It also directed Apple's default Safari browser to reach out for new malware from specific Websites created for that purpose.
"Our research shows that despite running inside the iOS sandbox, a Jekyll-based app can successfully perform many malicious tasks, such as posting tweets, taking photos, sending email and SMS, and even attacking other apps all without the user's knowledge," says Tielei Wang, in a July 31 press release by Georgia Tech. http://www.gatech.edu/newsroom/release.html?nid=225501 Wang led the Jekyll development team at GTISC; also part of the team was Long Lu, a Stony Brook University security researcher.
Some blogs and technology sites picked up on the press release in early August. But wider awareness of Jekyll, and its implications, seems to have been sparked by an August 15 online story in the MIT Technology Review, by Dave Talbot, who interviewed Long Lu for a more detailed account.
Jekyll "even provided a way to magnify its effects, because it could direct Safari, Apple's default browser, to a website with more malware," Talbot wrote.
A form of Trojan Horse malware, the recreated Jekyll, once downloaded, reaches out to the attack designers for instructions. "The app did a phone-home when it was installed, asking for commands," Lu explained. "This gave us the ability to generate new behavior of the logic of that app which was nonexistent when it was installed."
Sandboxing is a fundamental tenant of secure operating systems, intended to insulate apps and their associated data from each other, and avoid the very attacks and activities that Jekyll was able to carry off. It's also explicitly used as a technique for detecting malware by running code in a protected space where it can be automatically analyzed for traits indicative of a malicious activity. The problem is that attackers are well aware of sandboxing and are working to exploit existing blind spots. [See "Malware-detecting 'sandboxing' technology no silver bullet"
Sign up for CIO Asia eNewsletters.