The anonymous attackers were able to gain access to all package that BigBoss offer (Free and paid) and made the deb index and database available for download. The assailants went as far as creating a new repo which can be added to Cydia to download all BigBoss-hosted tweaks.
Dubbed ripBigBoss, the website and companion repo are using Saurik’s recent “Competition vs Community†as a motivation for their acts, pushing the use of the #WhichSideAreYouOn and #SupportTheCompetition hashtags. It’s important to note that this verbiage could certainly be used as some sort of disguise in order to blur their tracks and put the blame on different groups of people.
As a safety measure, and until more light is shed by official parties on this, we suggest not installing or updating tweaks that are hosted in the BigBoss repo. While the potentiality of malware being injected in the official repo is very unlikely, you’re better safe than sorry.
UPDATE: We’ve got the following statement from Saurik:
This article mentions malware being potentially injected into the BigBoss repository; we do not believe this to be the case. Packages in Cydia repositories are cryptographically verified from the repository package index. I have an index of all historic changes to the package indices for default repositories, and have verified that the content on BigBoss did not change in ways that the repository administrators did not expect.
