- Twitter faces backlash for insensitive ‘triggers’ joke 3 Years Ago
- 10 user-recommended sites for live tarot readings that are almost too good to be true Today 12:08 PM
- AsapSCIENCE comes for Jake Paul over Mystery Brand scam Today 11:34 AM
- Why ‘I never thought of it like that’ can actually be deeply offensive Today 11:26 AM
- Save 40% on the Fire TV Stick 4K when you rent textbooks through Amazon Today 11:05 AM
- Netflix reportedly used real disaster footage in ‘Bird Box’ Today 10:53 AM
- Holocaust denier Chuck Johnson spotted with 2 congressmen in Capitol Today 10:30 AM
- YouTuber who made popular Darth Vader fan film prevails in copyright fight Today 10:09 AM
- Mariah Carey says she ‘doesn’t acknowledge time’ in her 10-year challenge photos Today 10:06 AM
- Beto O’Rourke under fire for supporting controversial Thin Blue Line Act Today 9:26 AM
- These surreal ‘logo misuse’ sections are hilarious, and they’re going viral Today 9:20 AM
- Senators lose their sh*t over Cardi B shutdown Instagram Today 8:45 AM
- Report: Michael Cohen made fake ‘Women for Cohen’ account that tweeted about how hot he is Today 8:32 AM
- ‘Dragon Ball Super: Broly’ unites fans and critics with major opening Today 8:07 AM
- Slack’s users roast the app’s new logo Today 7:17 AM
KeyRaider hack steals more than 225,000 Apple logins from jailbroken iPhones
If you have a jailbroken iPhone, your account information could be compromised.
If you decided to jailbreak your iPhone, your login credentials could be at risk. A recently discovered family of malware has collected nearly a quarter-million usernames and passwords for Apple accounts.
KeyRaider is distributed through a repository downloaded from popular third-party app distribution platform Cydia. Malicious code included in apps downloaded from the alternative app store is responsible for the breach.
More than 225,000 people have had their accounts compromised by KeyRaider, making it the largest security breach caused by malware. Users from 18 countries including China, Russia, Japan, United Kingdom, United States, and Canada have been affected. Some users have reported their information is being held ransom, having their account disabled until they pay a fee.
The malware appears to be circulating through tweaks to the repository made by a person operating under the username mischa07. Tweaks often add features and actions that aren’t possible in the official iOS release. The two tweaks provided by the user purported to make it possible for downloaders to make in-app purchases from official App Store apps without actually paying.
Palo Alto Networks researchers explained how the malware works, writing, “These two tweaks will hijack app purchase requests, download stolen accounts or purchase receipts from the C2 server, then emulate the iTunes protocol to log in to Apple’s server and purchase apps or other items requested by users.”
The user mischa07 has uploaded other tweaks as well according to PCWorld, including ones that provide cheats for mobile games, controls for system settings, and in-app ad blockers.
Chinese technology firm WeipTech was able to obtain about half of the database of stolen accounts and created an online checker that can inform you if your account has been compromised (though you’ll have to use Google Translate if you can’t read Chinese).
The data was obtainable because the website the data was uploaded to was susceptible to SQL-injection attacks, which WeipTech exploited to grab the information. This means it could also have been acquired by another source with less-charitable intentions.
If you have not jailbroken your iPhone, you are not at risk of this attack. Security experts have long warned of the risks of leaving the walled garden of iOS and exploring the less-secure world of jailbroken apps. Malware like KeyRaider is just one of the potential malicious exploits out there.
AJ Dellinger is a seasoned technology writer whose work has appeared in Digital Trends, International Business Times, and Newsweek. In 2018, he joined Gizmodo as the nights and weekend editor.