Okay so this week's been a weird one if you write iOS apps for a living, or even just as a side thing the way I do on weekends. XcodeGhost. If you havent heard of it yet you will, because by the time this post goes up its already looking like one of the messier App Store security stories in a while.
Quick version for anyone who doesnt live on Twitter dev accounts all day: someone built a tampered version of Xcode (Apples IDE, the thing you compile iOS and Mac apps with) and uploaded it to Baidu Yun, which is basically the Chinese equivalent of Dropbox. Why would anyone download Xcode from a random cloud storage link instead of straight from Apple? Because Apples own developer downloads are notoriously slow in China, sometimes crawling along at speeds that make a multi-gigabyte Xcode install take most of a day. So a bunch of devs, pretty reasonably honestly, grabbed a mirrored copy instead to save themselves the wait.
Except that mirrored copy had extra code baked into its compiler frameworks. Anything built with it got a little present slipped in - code that could phone home, read clipboard contents, and pop fake alert dialogs asking for iCloud passwords. Because it was baked into the compiler itself rather than sitting in the app source somewhere a reviewer might spot it, it slid right past Apples review process without anyone raising a flag. A pile of apps got compiled with it before security researchers caught on. WeChat, which is basically required software for a sixth of the planet at this point, was one of them. So were a bunch of other big China-market apps that most of us outside China have never even heard of.
Apple's been yanking the infected apps off the store this week, and developers have been scrambling to recompile clean versions and push updates. Which, fine, thats the system working eventually. But it took outside security researchers poking around to catch this, not Apples own vetting, and that gap bugs me more than it probably should.
Heres the part that actually got under my skin though, and its not really about China specifically, its about all of us. Ive, at various points, definitely downloaded dev tools from somewhere other than the official source because the official source was slow or down or stuck behind some login flow I didnt feel like dealing with. Homebrew formulas pulling from mirrors. Random gem or npm packages I never bothered reading the source of before installing. We all do this constantly and mostly it works out fine, so we stop even thinking about it. XcodeGhost is a pretty good reminder of what "mostly fine" has been quietly hiding.
Its not even a new idea. Compiler-level trojans go back to Ken Thompsons "Reflections on Trusting Trust" lecture from the 80s, which if you havent read, go read it, its like four pages and it will mess with your head a little. The scary part isnt that someone can hide malware inside an app. Its that they can hide it one level down, in the tool that builds the app, exactly where nobody is looking.
Practical stuff if youre a Mac or iOS dev reading this: check the checksum of your Xcode installer if youre ever getting it from anywhere but the Mac App Store or developer.apple.com directly, and honestly, just eat the slow download when you have to. A few hours of waiting beats finding out later your app shipped a password-phishing dialog to a few million people. Not a groundbreaking take, I know. But apparently it needed saying, because a lot of clearly competent developers skipped that step here, and not because they were careless. It was because the official channel just wasnt good enough for where they happen to live.
Anyway. Go check your build chain. Ill be over here not feeling too smug about any of this, because Ive absolutely cut corners on smaller things than a full IDE download before, and I dont have a great excuse for it either.