US officials warn that iOS devices are vulnerable to an app-related security flaw

The US Computer Emergency Readiness Team (CERT) has issued an alert to all iOS users warning them that they are vulnerable to a unique form of attack from installing harmful apps. They’re dubbing it ‘Masque Attack’.

Devices running iOS 7 and above are vulnerable to the attack, which involves users being tricked into installing malicious apps from sources other than Apple’s App Store. The alert indicates that the attack works because iOS is unable to distinguish between official and unofficial apps if they have the correct Bundle Identifier (a unique key that allows the system to identify your app).

Apple has released a statement, which is the same as the statement it released for the Wirelurker issue from a couple of weeks ago. Nice and simply, Apple tells us that we should only download apps and updates from trusted sources i.e. one of Apple’s own App Stores. In addition to that an Apple spokesperson said, “Enterprise users installing custom apps should install apps from their company’s secure website.”

The trouble here, however, is that attackers seem to be able to successfully pose as corporate users’ IT staff. Fortunately both Apple and FireEye, the security firm who found the exploit, claim that there are no recorded instances of this vulnerability being exploited.

So you have been warned, be careful out there.