iOS Jailbreak Backdoor Tweak Compromised 220,000 iCloud Accounts

The recent security breach on iOS platform left 220,000 iCloud user accounts vulnerable due to a backdoor privacy attack caused by the installation of a malicious jailbreak tweak, according to an online Chinese vulnerability-reporting platform WooYun.

Yes, 220,000 is a huge number considering it happened to iOS, one of the most popular mobile operating system that is designed by Apple. But don’t get too frightened because this security flaw has nothing to do with Apple’s security and happened after a jailbreak attempt.

Firmware Worm Permanently Infects Macs in Seconds

WooYun is a Chinese platform that reports on user submitted security flaws discovered by the researchers in an attempt to provide feedbacks to relevant vendors. So it is, in fact, a reliable website.

According to the post on their website, they have outlined the details about this backdoor attack that breached 220,000 iCloud accounts because of the installation of a malicious jailbreak tweak. In the page, they have also mentioned that the notification about the security flaw has already been issued to the appropriate vendors –apparently Apple.

Below is the (slightly broken) translated version of the report.

What should make the iCloud users worried is that if your account credentials are breached then it is surely going to have a negative impact as the leaked credentials grant an easy access to your personal information stored in the iCloud including all your photos and contacts.

Now you must be wondering that what the reason behind the flaw is. One of a Reddit user, self.jailbreak created a dedicated post about the issue where he outlined that the security breach affected the users in a specific region only and had abounded reach.

“This was announced by a China security website WooYun (it means Black cloud in Chinese based on sound) earlier on their Weibo, and it is basically telling that there are some shady tweaks that have back-doors is stealing Jailbreak user’s iCloud account and password to a remote server, which so far there are roughly 220 thousand accounts has been leaked. They haven’t announce that who stole it and what for, but as far as we know that, if they hack into our iCloud accounts, they can have access to our mails, photos or even private stuff.”

So considering how privacy conscious the iOS jailbreak community is and the tweaks and plug-ins released by them is secure, which makes it highly unlikely that a malicious jailbreak tweak would affect such a huge number of users, and that too by the installation of a single tweak or plug-in.

Here is the proof of the leaked iCloud account data, but apart from this picture, there is nothing else has been surfaced on the Internet yet!

One of the related Reddit users posted a valuable comment on the post that says:

“In Asian countries, it is very common for people to buy phones, new or used, from technology markets. At those markets are lots of competing stalls selling phones, and jailbreaking your phone and selling it to you preinstalled with lots of jailbroken / pirated apps is part of their service.

That is part of why jailbreaking / Pangu is so popular in Asia / China. There are entire markets of Chinese-only programs and apps that we are not really exposed to here on this English- / Western-dominated subreddit.

Anyway, my point is that if one of these “shady” apps is something that was somewhat common for these 3rd-party sellers to install, then this stat wouldn’t be that surprising. It doesn’t take 220,000 people with personal tech know-how to jailbreak and download a tweak: it just takes 220,000 people buying from a few hundred / thousand technology boutique shops that preload the software.”

He did raise a valuable point here that it seems like this attack is caused by the installation of malicious tweaks and plug-ins by the third-party sellers, and then the users used those infected devices resulting in a breach of their accounts.

How Can You Protect Your iCloud Account?

We all know that jailbreaking your iOS device makes it vulnerable to malicious attacks resulting in an increased risk. To protect yourself from these malicious attacks, it is recommended you to take the following precautionary steps:

Tip #1 – Enable two-factor authentication on your iCloud account.

Tip #2 – Don’t download tweaks from any untrusted or third party repository.

Tip #3 – Stay away from pirated apps or tweaks.

But still, even after following the above-mentioned tips you might be vulnerable to security threats because a jailbroken device is never secure!

Report typos and corrections to [email protected]

WooYun