Last week, news emerged that a small percentage of App Store apps on iOS devices have been infected by malware injected into versions of Xcode not directly downloaded from Apple’s website. In response to these hacks, Apple has today urged developers to validate their version of Xcode and ensure they only download new versions from Apple. The Cupertino-based company notified developers of the situation this morning via email:
We recently removed apps from the App Store that were built with a counterfeit version of Xcode which had the potential to cause harm to customers. You should always download Xcode directly from the Mac App Store, or from the Apple Developer website, and leave Gatekeeper enabled on all your systems to protect against tampered software.
When you download Xcode from the Mac App Store, OS X automatically checks the code signature for Xcode and validates that it is code signed by Apple. When you download Xcode from the Apple Developer website, the code signature is also automatically checked and validated by default as long as you have not disabled Gatekeeper.
Whether you downloaded Xcode from Apple or received Xcode from another source, such as a USB or Thunderbolt disk, or over a local network, you can easily verify the integrity of your copy of Xcode.
Apple has also posted a message to developers on its website with additional information. Apple has provided developers with a command line tool for validating that their version of Xcode is not infected. Apple also has recommended that developers install a clean copy of Xcode downloaded directly from Apple’s Developer Portal (via the Mac App Store) before submitting a new app or app update to the App Store.
In related news, Apple’s Phil Schiller told Sina that no malicious apps actually transmitted any user data:
FTC: We use income earning auto affiliate links. More.
Didn’t Apple say that they could re-compile apps on the fly with the new App Store in iOS 9? You would think that this would fix the issue instead of having to wait on developers to recompile with a legit version of Xcode.
That requires that developers submitted their app with Bitcode enabled. This feature has been available less than two weeks, and developers can still opt-out of Bitcode.
No developer would and should ever download XCode from any non Apple servers directly.
Whoever did that is guilty. Apple should sue all those that used the illegal XCode. They should ban all of them forever.
There is no excuse for using an illegal XCode with illegal authorization keys that someone inside Apple clearly working for competitors to damage Apple itself allowed the illegally compiled apps and games with the fake authorization keys to both get approved and bypass all security measures including both automatic and manual reviews to get those approved.
And i just screwed up my OS X system today is not a good day