No Source Code? No Problem! Demystifying and Detecting Mask Apps in iOS

The rise of malicious mobile applications poses a significant threat to users and app stores. While iOS apps have generally been considered more secure due to strict review processes and limited distribution avenues, developers have found ways to evade scrutiny by disguising malicious apps as benign “Mask Apps”. Mask Apps activate hidden functionalities after the user downloads or with a trigger event. The malicious and potentially illegal hidden function poses significant risks, including privacy breaches, security vulnerabilities, and harm to legitimate businesses. However, existing defenses are ineffective against Mask Apps developed in web or hybrid models. In this paper, we propose Mask-Catcher, an automated approach that uses four filtering mechanisms to detect Mask Apps. Mask-Catcher leverages inconsistencies between app descriptions and user reviews, inter-app recommendation relationships, and code similarities to discover and identify Mask Apps. Experimental results show that Mask-Catcher achieves high recall and precision when applied to real-world datasets from the Apple App Store. CCS CONCEPTS • Security and privacy $\rightarrow$ Software and application security.