Popular Chinese iOS apps compromised in malware attack

Re:Popular Chinese iOS apps compromised in malware attack by majke on Saturday September 19, 2015 @05:56AM (#10243833)

A checksum can only tell you if the file is identical to another. Even if it did - you downloaded the file from untrusted location for a reason - you don't have access to original source.

Checksums are useless if you don't have access to an alternative source.

[ Parent | on HN ]

Re:Popular Chinese iOS apps compromised in malware attack by rsy96 on Saturday September 19, 2015 @07:11AM (#10243951)

Xcode.app includes a digital signature, which can be checked with `codesign`. As all OS X comes bundled with Apple's root certificate, one can check for the validity of that application by oneself without any additional trusted source.

Or if the developers never disable GateKeeper and read the warning, they will know that the application is not genuine.

[ Parent | on HN ]

Re:Popular Chinese iOS apps compromised in malware attack by pki on Saturday September 19, 2015 @08:15AM (#10244072)

Of course being China, of course Gatekeeper is totally disabled and no one has valid signatures on anything unless it's absolutely required

[ Parent | on HN ]

Re:Popular Chinese iOS apps compromised in malware attack by paradite on Saturday September 19, 2015 @05:59AM (#10243837)

> you don't have access to original source.

Not true, they have access to original XCode (and checksum), but the download speed is very slow.

[ Parent | on HN ]