BOSTON (Reuters) - Cybersecurity researchers have warned that a bug in Apple Inc's
Cybersecurity firm FireEye Inc
The malicious application can then be used to replace genuine, trusted apps that were installed through Apple's App Store, including email and banking programs, with malicious software through a technique that FireEye has dubbed "Masque Attack."
These attacks can be used to steal banking and email login credentials or other sensitive data, according to FireEye, which is well-regarded in cybersecurity circles for its research.
"It is a very powerful vulnerability and it is easy to exploit," FireEye Senior Staff Research Scientist Tao Wei said in an interview.
Officials with Apple could not be reached for comment.
Wei said that FireEye disclosed the vulnerability to Apple in July and that representatives with the company have said they were working to fix the bug.
News of the vulnerability began to leak out in October on specialized web forums where security experts and hackers alike discuss information on Apple bugs, Wei said.
Wei said that FireEye decided to go public with its findings after Palo Alto Networks Inc
FireEye does not know of other attacks that exploit the bug, Wei said.
"Currently WireLurker is the only one, but we will see more," he said.
FireEye advises iOS users to refrain from install apps from sources other than Apple's official App Store and to not click "install" on a pop-up from a third-party web page.
The security firm said it verified this vulnerability on iOS 7.1.1, 7.1.2, 8.0, 8.1 and 8.1.1 beta, for both jailbroken and non-jailbroken devices.
(Reporting by Jim Finkle; editing by Andrew Hay)