Spyware targets Hong Kong protestors using Android, jailbroken iPhones or iPads

There’s a new kind of spyware going around called Xssar that’s reportedly targeting protestors in Hong Kong. The spyware — which appears to have ties to Android malware discovered last week — is installed via a Debian package and requires a victim’s iPhone or iPad to be jailbroken. Breaking the root jail of iOS can provide for functionality beyond what Apple currently ships, but also strips away Apple’s built-in iOS security. The same way jailbroken software can be loaded, malicious software can be loaded. So what’s going on with Xssar and how can you protect yourself?

Reuters has a quasi-report up that mislabels Xssar as a virus, doesn’t link back to its source, and neglects to mention that only jailbroken iOS devices seem to be vulnerable, but does provide the following overview:

The malicious software, known as Xsser, is capable of stealing text messages, photos, call logs, passwords and other data from Apple mobile devices, researchers with Lacoon Mobile Security said on Tuesday. They uncovered the spyware while investigating similar malware for Google Inc’s Android operating system last week that also targeted Hong Kong protesters. Anonymous attackers spread the Android spyware via WhatsApp, sending malicious links to download the program, according to Lacoon.

Lacoon itself is more thorough:

Lacoon hasn’t uncovered information regarding the method or vector of attack. The iOS device needs to be jailbroken in order to be infected. Then with Cydia installed, the repository would be need to be added and then the package could be installed. All that’s known is that both the iOS and Android attacks share a CnC server. The package itself is a debian .deb package. The package installs an iOS ‘launchd’ service to make sure the app starts after booting and in addition starts it up immediately.

If you think you’re at risk from Xssar, until more is known about how it is being spread, removing your jailbreak by upgrading or restoring to an official version of iOS is the best way to protect yourself.

Nick Arnott contributed to this article.



Path takes laziness to a new level with business messaging

Apps are making it a little too easy to avoid fellow humans. You don’t have to hail a cab, order food delivery over the phone, or even walk down to the
laundromat, all thanks to apps. But sometimes you have queries that need to be answered by actual people. Don’t worry: Path will handle that for you.

path places

You can “message” businesses on Path Talk, which really means that Path reps call businesses for you.

The social network, once considered a Facebook rival, in June spun off its chat feature into a stand-alone app called Talk—like Facebook
did with Messenger. Path also bought messaging app TalkTo, which lets you text a business with questions. Now Talk and TalkTo have been combined so you can message a place directly from Talk.

To read this article in full or to leave a comment, please click here

PayPal, Apple Said to Cease Apple Pay Negotiations Following Samsung Deal

Reports that PayPal was trying to cozy up with Apple for its mobile payment system are almost as old as the rumors about Apple Pay itself. We last reported on the rumors way back in January, and now a new report from Bank Innovation (via MacRumors) claims all that work came to naught. In fact, the veteran Internet payment company apparently signed a deal with Samsung to power its own fingerprint payment system for its Galaxy S5 units.

Apple apparently made the decision to end the talks. Understandably, PayPal’s move incensed the Cupertino company, and it’s said that the partnership with Samsung led to Apple’s surprise decision to exclude PayPal from the dev kit for Apple Pay entirely.

The deal with Samsung “was reportedly forced onto PayPal by eBay CEO John Donahoe,” the report says. “PayPal’s now-former president David Marcus was purportedly categorically against the Samsung deal, knowing that it would jeopardize PayPal’s relationship with Apple. Donahoe won the day, however.”

The rift between the two companies seemingly runs deep now, and its effects were more visibly seen in a recent PayPal ad in the New York Times (also noted by MacRumors) that pointed to the iCloud celebrity snafu as proof of the comparative safety of its payment service, which greatly resembles Apple Pay in concept. “We the people,” the ad read, “want our money safer than our selfies.” Ouch.

But business may soon get rough for PayPal. Word also dropped today from CNN that eBay plans to split PayPal off as its own company again despite recent successes, which only adds to the clash between Marcus and Donahoe. And if Apple Pay turns out to be as “cool” as Apple CEO Tim Cook hopes, PayPal could end up fighting for its very survival. For its part, eBay (which still owns PayPal for now) now claims to welcome the competition from Apple Pay, as reported by MarketWatch.

“I’m hoping that the recent tokenization and Apple Pay announcements begin to accelerate the pace of NFC (near-field communication) adoption. I don’t know if that will be the case, but if it does, we think that’s a very good thing for PayPal,” John Donahoe said in the report.

Follow this article’s writer, Leif Johnson, on Twitter.

The Week in Mac Apps: Sketching, taking notes, and keeping track of things