We detected network traffic from a device infected with xcodeghost trying to reach a known bot command and control address. Obviously, we removed the device from the network. The user removed two applications that were mentioned in articles about xcodeghost, but we really have no way to be sure that those were the culprit apps do we? If we let them reconnect, we run the risk that we won't detect further traffic to other, unknown bot networks.
My first instinct is that we should force this user to re-image the device before we allow them to reconnect to the network. I think I've answered my own question, but I wanted to check here to see:
- do any tools exist to detect and/or clean xcodeghost.
- Has anyone here dealt with xcodeghost on a byod device? What was the resolution?