The truth about XCode Ghost – UPDATE

XCcode Ghost

See my update below.

As this already goes around in the news and not only in the technical press, you will have heard about the XCode Ghost issue and the so claimed “Apple’s biggest malware attack”.

What happened is in short: Some developers, mainly from China downloaded the so called XCode development environment, which is required to develop Apps from dubious websites instead of Apples official website or Apples App Store. The version they downloaded was infected and so were the Apps produced by this XCode version. Some Apps made it to the App Store and some are still available for downloading.

So far, so bad. Scary, isn’t it.

No, it’s not that bad.

Unfortunately, the press and even the people from paloalto networks who “revealed” this story first are currently mystifying this subject rather than informing fully and correctly. They even provide misleading and even obviously wrong information.

So here is my story:

I personally found one of the effected Apps on my device (CamScanner this App has yet been removed from the Store so I can’t provide the link). I reverse engineered this App and can confirm that it indeed contains the XCode Ghost “Virus”.

Further investigation of the code revealed that this code is almost harmless. At least as harmless as all the damn Flurry, AppCrashLog, UserActivity Libraries I am complaining about for quite some time.

It “just” collects even less than Flurry does and submits it to a server ( There is DEFINITELY NO key logger included, NO POPUP will be displayed that asks for an Apple ID/iCloud access or something similar. The rumors about this are absolutely wrong.

Of course, the code could have been more dangerous and my finding depends on just one App so this is not an “all-clear”.

However, most likely it is not as bad as the press writes. There is no prove (maybe yet) that there is any App “infected” in a way that user’s security is affected.

The reason why I am very confident about this is, that I was able to find the source code on the Internet which is 100% identical to the code I found in CamScanner and that also fit’s 100% to the story of paloalto networks. That source code is also garnished with a Chinese “excuse me” of the developer who is claiming to be the author of XCode Ghost.

Take a look yourself here: (maybe use Google translate to read it)

Until there is no further prove otherwise, I assume that this is exactly the code which is included now in some Apps on the App Store.

Apple is currently trying to identify these Apps (which should not be too difficult) and removing them. I however would also expect a list of these Apps from Apple (not like the one on the paloalto website which contains spelling errors and App Names that are available several times on the App Store) so we know which Apps may still reside on our devices.

For your information, and that’s also missing in all the other press statements, you just need to delete the App and it’s gone. There is nothing that remains on your device after you delete it.

And here is, what you can do as NetworkToolbox user:

As explained earlier, my App contains the recently introduced Connections tool. This is ideal to identify such unwanted connections. I just wrote a small tutorial which explains how to detect XCode Ghost using NetworkToolbox.

You may wonder what Apple can do to prevent this from happening in the future. To be honest, so far, there is nothing to blame Apple for right now because (as mentioned before) this code is “harmless” in terms that it doesn’t access secured information and it doesn’t use private APIs. Otherwise I would have been quite sure that Apple would have rejected the Apps (as happened to my Apps).

The most people that have to be blamed are the developers that downloaded XCode from the dubious websites and used it for submitting the Apps to Apple using it. The same thing could definitely have happened on the Microsoft Platform. Maybe even easier because Microsoft does not offer some real App Store approval process at all.Not to talk about Android where there is no protection at all for way easier kind of injections with way more uncontrolled device access.

But I guess, Apple will now most likely speed up and shorten the grace time period for developer of Apps that now have to use HTTPS/TLS rather than HTTP and need to announce and name all domains that their App connects to.


For long time, it seemed that I am the only one claiming that XCode Ghost is relatively harmless. All the so called ‘Security Researchers’, the big press like the German ‘Tagesschau’ and even Heise never got tired of repeating the same story that XCode Ghost has been the biggest hit to iPhone App users security ever and everybody is at risk.

Recently also FireEye (who already is one of my friends) was dared to say that they experienced some MITM (Man in the middle attacks) and offered to “protect their customers” against XCode Ghost.

I sent a lot of mails to those researchers and companies telling them that they are wrong in their assumptions and that they should spend a few minutes in analyzing the code. Probably that was either too difficult for them or they just didn’t listen.

For instance, I asked FireEye what the heck they think how MITM attacks could compromise the users of Apps with XCode Ghost. No answer. Dead end. Probably because the answer is, it makes absolutely no sense at all.

There are still numerous false alarms regarding Phishing and Clipboard interception capabilities of XCode Ghost.

Unfortunately, this all was said by inexperienced, unthinkingly, ignorant, arrogant and attention addictive so called security researchers and the unfortunate so called “press” and security websites just copied and pasted their wrong conclusions.

For me, this is definitely the real issue with XCode Ghost.

Anyway, I gave up repeating the truth about it, hoping many people will read this post and come to their own conclusion.

But it was nice to see that I am finally not alone with my conclusions. See here:

Don’t trust the evil!



Check for ATM Skimmers with NetworkToolbox

atm2Nowadays, ATM Skimmers use Bluetooth to transfer your stolen credit/debit card details and PIN code.

Brian Krebs today talked about this in a great story where he visited some Hotels in Mexico (even one I stayed in a few years ago) and found several Bluetooth Skimmers.

The hacked ATMs are using Bluetooth modules that are used to download the collected data from the Skimmer inside the ATM. This way, the criminals don’t need to get very close to the ATM to download the stolen data.

Even though this is another scary escalation of the Skimmer technology, the Bluetooth modules can be discovered even by NetworkToolbox. The Modules Brian found are standard Bluetooth modules from a company called Free2Move and that’s also the name these Bluetooth devices are propagating.

There are Bluetooth Modules available for Bluetooth 1.0, 2.0 and even 4.0 (LE) so you will have to discover all three standards. Bluetooth 1.0 and 2.0 devices can simply be discovered by going to the Settings screen of your iPhone, select Bluetooth, switch Bluetooth on if it’s off and wait if your iPhone discovers new Bluetooth devices around you. If you see “Free2Move” when standing close to the ATM you may better want to look for another ATM.

For Bluetooth 4.0 or Bluetooth LE (Low-Energy) you can use the Bluetooth Scanner which is included in NetworkToolbox (Please note: you need to have at least an iPhone 4s for this). Just run a Scan and check the names of the discovered devices and look for “Free2Move” or anything else that doesn’t look obvious.

Of course, the Criminals can change the name but so far, the Skimmers found by Brian Krebs can be discovered this way. At least I will try it whenever I am using an ATM and will let you know once I find a Skimmer or once I got suspected as criminal when standing in front of the ATM and do my scanning ;-).

Don’t trust the evil,

have a secure day,






WordPress WPML Multilingual plugin – better switch if you still use it

This story is not really related but I had to write it. Simply skip if you don’t use WordPress.

I am using WordPress for most of my Websites and some time ago I purchased the WPML plugin for easier handling of multi-language pages. This plugin wasn’t cheap (about 200 Bucks) but I thought it’s worth it. Little later, after using WPML for a while and after almost getting used to the cumbersome UI and weired bugs, I heard rumors about security issues with WPML. So I looked for updates and headed to their support forum. After reading that they are not really able to fix these issues soon because of issues with their update procedure, I took a look into their PHP code. After this, I knew I have to disable WPML immediate and switch to another solution.

It took me quite some time to find and migrate to another solution but thanks God I did. Later I forgot about WPML.

A few minutes ago, I received the following mail:


So in that mail WPML claims that they updated my password to a strong and secure one (I always thought I am using strong passwords by the way). Further down, they sent me the new password in plain text and EVEN added the Login name (for my convenience I guess) to that mail.

But it got worse. When inspecting the included link they added to the login page (probable even for my convenience) I found it contains the address of a redirect PHP on a completely different server.

At that point, I was pretty sure that this must be one of those usual phishing mails and just in case, I sent a mail to WPML (using the contact form) to inform about this.

Seconds later, they confirmed that this mail was real.

Isn’t that unbelievable ?

I think this finally proves that WPML definitely has no clue about security. So everybody who is still using WPML (probably not too many still) now know that they better switch to something else.

As a site note: WPML can be found on which is ok. But is available for sale. Imagine what happens if a bad guy would acquire But it’s not cheap I must admit.

Anyways, don’t trust the evil.

Best Regards,


Should we uninstall anti-virus software such as Sophos, ESET, FireEye and Kaspersky ?

Regular readers of my blog know that I am no fan of anti-virus software.

Now, here is another argument against them. Tavis Ormandy recently exploited successfully Kaspersky in a way that users could find their systems easily compromised. Just recently he did the same for Sophos and ESET and even this Sunday, Kristian Erik Hermansen disclosed a zero-day vulnerability in another Malware protection solution from FireEye, which if exploited, results in unauthorized file access.

My personal opinion is that the good old days for those companies are over. Instead of continuing to invest in good security engineers and software developers, they spent their money rather for advertising, fighting against their competitors and seeking for additional ways to make money.

I guess all of you had once your own issues with your preferred virus-scanner or security suite (how they are nowadays called). Dramatical slow-downs, unreachable websites, odd browser behavior, undelivered mails or completely messed up firewall rules. All issues that suddenly disappeared once you switched off or uninstalled the virus scanner. Don’t you ? And for us network admins, isn’t it always scary when the preferred scan engine on the server gets updated because you still remember the server outage due to such an scanner update.

But you thought that this is the price we have to pay for increased security. Now we have learned that we even loose security when using Anti-Virus software.

My suggestion: Don’t use them! Stick with the built-in security measures of Windows, Mac or Linux. Use a good router, use NAT, use Firefox (or if you don’t like Firefox use Chrome for God’s sake) but always keep everything updated. This is all you need for regular browsing and working. The built in Windows defender for instance is not too bad at all. Even though those brave computer magazines regular tests show it never #1 in scanning accuracy. A few pages later you can learn why when reading the big advertisings of these Anti Virus companies.

In addition: if you have to visit suspicious websites or servers or need to access dubious systems or have to do some downloads and to unzip and install files from insecure sources: Never ever do this on your production system. At least setup a virtual machine or better use a separate computer running on a separate IP address space. This is easy to do, easy to recover in case of issues and the best protection you can get.

Don’t trust the evil,

Best regards,










Babies and families at risk!

Maybe this is another bad coincidence. Shortly after my findings regarding the quite insecure ALDI / MAGINON web cameras, Rapid7 informs about IoT security issues, especially about 10 New Vulnerabilities for Several Video Baby Monitors.


There is nothing to add to this scary report except that this is just again another example of incompetent developers, IT and quality assurance departments of ‘well known’ companies. I hope all of them get fired but maybe they deserve something worse. For instance, that their family or kids get stalked. No – This is something we should not wish to anybody. This would be wrong. But they didn’t seem to care about your family and privacy.

To check your own devices, I just updated the default password database of NetworkToolbox accordingly.

Don’t trust the evil!


P.S. NetworkToolbox now has it’s own dedicated Facebook page.