{"id":19183,"date":"2020-11-02T09:58:01","date_gmt":"2020-11-02T14:58:01","guid":{"rendered":"https:\/\/nuxx.net\/blog\/?p=19183"},"modified":"2020-11-02T10:01:21","modified_gmt":"2020-11-02T15:01:21","slug":"mail-hijacking-malicious-profile-on-ios","status":"publish","type":"post","link":"https:\/\/nuxx.net\/blog\/2020\/11\/02\/mail-hijacking-malicious-profile-on-ios\/","title":{"rendered":"Mail-Hijacking Malicious Profile on iOS"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

I was recently asked to look at a family member’s iPad because it was no longer sending email. Turns out that it had been set up to use an additional email account that steals copies of all their outgoing mail. Unfortunately, they didn’t notice until the attacker’s system stopped working and the iPad started showing an error message. Besides the irritating (or worse) spam they saw, their stolen emails could have been used for anything from spear phishing<\/a> to accessing one’s online accounts, impersonating them, phishing others, delivering targeted spam, fake news \/ propaganda, etc.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

So how did this get set up?<\/p>\n\n\n\n

Apparently at some point this person installed the My Accurate Forecast<\/a> app [1]. Included in this app was a Profile<\/a> — or a set of settings for Apple devices — that added a second email account with address lazaroburst@my.minbox.email<\/em>. This account was also set as the outgoing server for their Hotmail (Outlook.com)<\/a> account.<\/p>\n\n\n\n

This person would then have seen all messages in this account, with notifications just like their normal Hotmail email. Worse, everything they sent, from any email account, went to the attacker first. As it’s a separate email account, all the normal spam and malware protections from a normal email provider don’t apply… It’s a firehose of junk straight to their mailbox, with outgoing mail theft frosting on top.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

This is bad because not only does it end up with them getting more spam, it allows the attacker to know exactly what they sent and to whom, and to modify those messages before delivering them to the intended recipients.<\/p>\n\n\n\n

I think this was likely generated based on geolocated advertising, but it’s possible this individual was specifically targeted. The signed Profile had a name of “WEATHER ALERTS”<\/em> a description of “Tap ‘Install’ above to get your local radar forecasts and weather alerts in 48062”<\/em>, showing its intent to deceive; trying to make the normal Profile installation security alert — which is supposed to warn the user of a change to important settings — look like part of an application install.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

I’m unsure when this first got installed, but judging by the the Profile signing certificate expiring on December 8, 2016 it was likely within a year or two prior. (Unfortunately I didn’t check the issuance date before deleting the profile.) The Profile which made these changes was signed by secure5g.com<\/a>, an “advertising” company which has ties to minbox.email<\/a> (the Unsubscribe<\/em> link at the bottom of the page is a generic link to a minbox.email page).<\/p>\n\n\n\n

A post from June 2018 on Medium, Unwanted Profiles Pop Up in iOS Devices, Inviting Spam and Malware<\/a>, reports the same problem almost two and a half years ago. Curiously, the handful of other posts I read about this (ref: 1,<\/a> 2<\/a>) didn’t mention (or maybe didn’t notice) the outgoing server change? Perhaps because they only noticed before things broke, or maybe this iPad somehow ended up different? (It does seem that at least one other app: Daily Bible Verse<\/em>, included similar email hijacking.)<\/p>\n\n\n\n

Cleaning this up these settings was easy, just a matter of removing the malicious Profile, outgoing mail account, and setting the Hotmail account back to using the appropriate servers. But, who knows what damage was done with the theft of the sent mail and receipt of spammy stuff.<\/p>\n\n\n\n

\n\n\n\n

[1] The My Accurate Forecast<\/a> website still shows screenshots of the app, but does not link to any app stores. It also no longer appears in the Apple App Store<\/a>, implying that it’s been pulled out.<\/p>\n","protected":false},"excerpt":{"rendered":"

I was recently asked to look at a family member’s iPad because it was no longer sending email. Turns out that it had been set…<\/p>\n

Continue readingMail-Hijacking Malicious Profile on iOS<\/span><\/a><\/div>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-19183","post","type-post","status-publish","format-standard","hentry","category-computers","entry"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/19183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/comments?post=19183"}],"version-history":[{"count":8,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/19183\/revisions"}],"predecessor-version":[{"id":19196,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/19183\/revisions\/19196"}],"wp:attachment":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/media?parent=19183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/categories?post=19183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/tags?post=19183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}