A key tool used primarily in iOS and macOS app development was vulnerable in a way that opened up millions of Mac apps to supply chain attacks, experts have warned.
Cybersecurity researchers EVA Information Security claim a dependency manager for Swift and Objective-C projects called CocoaPods, carried three vulnerabilities in a “trunk” server used to manage CocoaPods.
One of the vulnerabilities resides in the verification email mechanism that the platform uses to authenticate pod developers. To gain access to an account, the developer would enter their email address associated with the pod, and then get a link sent to their email. However, the URL in the link could be altered to redirect the developer to a server under the attackers’ control.
Millions of people at risk
The second vulnerability allowed threat actors to take over pods abandoned by developers – but still used in apps. The third vulnerability grants the attackers the ability to run code on the trunk server.
Since roughly 3 million mobile apps are using some 100,000 libraries found on the platform, the attack surface is quite big. To make matters worse, once the library is altered, the apps using it would update it automatically, with no interaction from the end user.
“Many applications can access a user’s most sensitive information: credit card details, medical records, private materials, and more,” the researchers said in their writeup. “Injecting code into these applications could enable attackers to access this information for almost any malicious purpose imaginable—ransomware, fraud, blackmail, corporate espionage… In the process, it could expose companies to major legal liabilities and reputational risk.”
The vulnerabilities were disclosed, and fixed, in October 2023 – and at the time, there was no evidence of in-the-wild abuse. Today, app developers and users are not required to do anything to secure their premises.