Yet another reason for iOS users not to jailbreak their handsets emerged this week after the release of a new report detailing AdThief – a relatively unheard of piece of Chinese malware already downloaded to 75,000 iPhones.
The malware, also known as Spad, works by hijacking advertising revenues and redirecting them to the attacker, according to a lengthy Virus Bulletin study by Fortinet researcher, Axelle Apvrille.
Each time user views or clicks on an ad, the corresponding application developer, partner or affiliate receives a small payment – what ad companies call “cost per thousand impressions” (CPM) or “click-through rate” (CTR), she explained.
Adkits identify developers, partners or affiliates with a developer ID, so that they can be credited when relevant ads are viewed or clicked.
“iOS/AdThief modifies this developer ID, replacing it with an identifier owned by the attacker. Revenues are consequently hijacked, with all of the revenue generated when an ad is viewed or clicked being assigned to the attacker’s identifier,” Apvrille continued.
“To modify the developer ID, the malware author implements a hook for each of the adkits he wants to hijack, where he replaces the developer ID as he wishes. To do so, he takes advantage of an existing process-hooking platform, Substrate, which is available on jailbroken devices.”
In this case the platform in question is a “Cydia Substrate” extension. “Cydia Substrate, which only works on jailbroken devices, is a platform for modifying existing processes,” explained Apvrille.
“It provides an API to hook the legitimate functions, and you can add your own tweaks. This is exactly what the malware does: it hooks various advertisement functions and modifies the developer ID (a.k.a. promotion ID) to match that of the attacker.”
Most of the 15 adkits targeted by the malware are Chinese, although four are US-based – including Google’s AdMob – and two are in India, she added. After analyzing some debugging information which was accidentally left in, Apvrille managed to track down the malware author as “Rover12421”.
“He says he worked on ‘spad’ a long time ago, that it was his only iOS project, and that it is now ‘closed’,” she wrote. “His answers aren’t very clear, but it seems he only wrote a basic ad ID replacement plug-in, and that someone else improved the code. He denies having participated in the propagation of the malware.”
That propagation has led to an estimated 75,000 infected devices, with revenue stolen from a whopping 22 million ads.
AdThief was actually first discovered by researcher Claud Xiao earlier this year but little was written about it at the time, according to Apvrille.