Documents released to The Intercept report that the CIA developed a poisoned version of the Xcode software development tool. This is used by creators of apps that are marketed to Apple users through the App Store.
Once installed, the hijacked Xcode could be used to steal passwords and retrieve messages from infected devices. It is alleged that data from apps could also be sent to an external “listening post” for analysis by CIA agents.
The Intercept report said: “The modified version of Xcode, the researchers claimed, could enable spies to steal passwords and grab messages on infected devices. Researchers also claimed the modified Xcode could ‘force all iOS applications to send embedded data to a listening post.”
Physical and non-invasive methods were used to crack the security wrappers around Apple’s devices. The goal of the operation was to decrypt Apple’s firmware, allowing unregulated access to the device at the lowest-level so that listening malware could be installed without the owners’ knowledge.
Security on Apple’s Mac OS X desktop operating system powering its iMacs and MacBooks was also reportedly targeted. The OS X updater utility was modified to allow the CIA to intercept a normal system update to include software and malware of its choosing, including keyloggers.
Apple announced yesterday at its “Spring Forward” event that a grand total of 700 million iPhones have been sold worldwide. This illustrates the scale of the issue if the CIA’s attempts were successful although the documents do not provide any insight into this.
The information is said to have come from a secret annual gathering called the “Jamboree” where gathered knowledge about Apple security mechanisms was shared in the CIA. This has been happening annually since 2006, a year before the launch of the first iPhone, implying that the CIA could have been cracking iPhone security even as it was being built.
