8 ms·

Handy Light: Tethering App Camouflaged as Flashlight

70 points by ajg1977 16y ago

jrockway 16y ago
I wonder how many other apps on Apple's "guaranteed-safe" App Store have hidden behavior like this? Since I can't actually audit the app code that runs on my device (like by compiling it myself), nor can I audit the OS, I guess I now have to assume that any application on my iPhone is compromised. (+) Apple should include a warning on the box to that effect. (+) I don't actually own an iPhone.
- chc 16y ago
  I feel pretty vindicated, because I've been saying all along that the App Store review process is pointless at best, because the things apps are usually rejected for are fairly petty and it has almost no way of picking up on anything but the dumbest malware.
  - IgorPartola 16y ago
    I think that should be "the things that people make a huge fuss about are pretty petty." I think that the review process adds a certain value to the App Store. I know that if I download an app, (1) it will run and (2) it will do more or less what the description says. That is not to say that this is the one true way, but it adds value. I think a model that the web has followed is better: apps should be ranked based on some organic factors (e.g.: content of description + reviews) and the best apps can just float to the top. Security can be ensured via reviews/ratings + sandboxes access to phone's core functions.
    - chc 16y ago
      I think you may have misunderstood the term "petty." Even the rejections people don't make a fuss about are fairly petty for the most part (dictionary definition: "of little importance; trivial"). They're mostly things like "You forgot this one guideline" or "You have a small bug in this part of the app."
      - IgorPartola 16y ago
        Same as the Debian policy. That doesn't seem to be a big deal in that community. Are the guidelines for the the App Store? Does it seem okay to ship a product with known bugs? Admittedly, I've never gotten an app approved by Apple, but as an iPhone user I can appreciate these things.
        Goladus 16y ago
        Well, ignoring for the moment that there's always some controversy with regards to contributions to Debian and other Linux distributions, Debian doesn't have an app store. If there is software you can't get using apt-get out of the box, for example, if you want the real firefox and not iceweasel, you might need to add a repository to your config file. Or maybe just wget a url and install a .deb file manually. Or you can just download the source and compile it yourself. Can't do any of that on the iPhone. It's the app store or you figure out some way to beat Apple's security.
        IgorPartola 16y ago
        My point with this is that while Apple is going about things the wrong way, they are in fact adding value. Simply removing the approval process and letting any app into the app store will be a bad thing.
- wallflower 16y ago
  Apps are sandboxed. They can send and receive data over http/https at will. Location sharing is much more audited in iOS 4. Your calendar data and some address book data is not well protected. Your pictures are only accessible through the camera roll UI; apps can't slurp them.
  - maxjg 16y ago
    Your contacts are pretty much completely unprotected as well. As an iPhone developer myself, I don't think it's unreasonable to have the device ask for permission to use this data (in a similar manner as location data access is approved).
  - ajg1977 16y ago
    Contacts (and in iOS 4, calendar data) are completely unprotected. Just create an instance of an AddressBook and go to town. Your pictures are only accessible through the camera roll UI... IF the developer is only using public APIs. Since we can assume that there are no public APIs that support tethering setup, we can also assume that it's still possible for them to be used in rogue apps and for developers to have access to private data.
    - pieter 16y ago
      You can make a perfectly fine SOCKS proxy without using any unpublished API's. It's just listening on one socket and then opening a new one based on the request.
    - bombs 16y ago
      It's possible to create a tethering app using public APIs. The APIs for HTTP/HTTPS connectivity and WiFi connectivity are public. Apple rejects apps that use private APIs.
      - tomjen3 16y ago
        How does Apple actually scan for private APIs? Couldn't you write the instructions necessary to make the private API call on the stack at runtime and then simply execute an assembly jump instruction?
- jsz0 16y ago
  Apple has never guaranteed the App Store is safe. They've pushed the idea that the App Store is safer than alternatives though. The iPhone EULA covers this.
- tvon 16y ago
  Well, that's pretty much the a basic OSS argument that's been around since day 1, just applied to a specific device.
donohoe 16y ago
If true, I guarantee that Apple will use their “kill switch” to remove this app from any iPhones that have it installed.
- jmatt 16y ago
  I bought NetShare when it was briefly on the app store and it still works. Or at least it did last time I was at my cabin a few months ago with my 3G. If they were going to kill an app, I'd assume they would have killed that. And they didn't. Or if they claimed to have killed it then they failed. I bought this app. I'm more than willing to support the the Rebellion. I haven't actually verified that this app works as demonstrated but for a dollar it's worth the risk. I have no intentions of paying another $20 a month to AT&T.
  - jmatt 16y ago
    This may sound silly now, but a long time ago I bought myLite - an iphone flashlight app. And when the app starts it has a frustratingly long and dark splashscreen before you get the actual light. Even as a flash light HandyLight outperforms myLite. When I start it - it's immediate white.
  - DLWormwood 16y ago
    > I bought this app. I'm more than willing to support the the Rebellion. I haven't actually verified that this app works as demonstrated but for a dollar it's worth the risk. I have no intentions of paying another $20 a month to AT&T. As a current iOS developer, I’ve always wondered what the financial repercussions of getting pulled from the App Store would be. I wouldn’t be surprised if Apple refused to pay the kid his post-commission cut from what he was able to sell due to this kind of hidden behavior.
    - bombs 16y ago
      The kid's under 18. You need to be 18 or over to sell apps in the App Store, as per the agreement. They could choose to pull his apps, remove his account and not pay him for that reason alone.
wallflower 16y ago
I wonder why this guy thought sacrificing his iPhone developer status was a good idea. If it gets 'remote killed', it was all for naught. Maybe he's going Droid. EDIT: He's just a kid > Hi, I'm Nick Lee, an aspiring 15-year-old web designer and programmer. I consider ...
- alextgordon 16y ago
  His app just hit the front pages of multiple high-traffic websites. It could well have been an excellent idea.
  - glhaynes 16y ago
    Why? Does he have something else to sell? Assuming he doesn't, he's just put his effort into learning what could be a valuable skill, but now can't work on the platform (ever again?).
    - lsc 16y ago
      > Does he have something else to sell? himself. If he wants to get a regular job later /or/ if he wants to launch a product later, having his name in the headlines helps quite a lot. i don't want to say "there is no such thing as bad publicity" because there is, but in this case, enough people, I think, will feel that a tethering application is 'not evil' and that this was overall a good thing to make it a net win for the programmer. Even if apple blocks him forever (I don't know their history... would they really say "no, f-ck you" five years from now?) and even if the apple platform remains dominant (I will be very surprised if apple continues its dominance after Jobs runs out of spare parts.) there are plenty of companies that make iphone apps that I'm sure would be happy to hire the kid. And there are plenty of other platforms out there to work on, too.
      - waterlesscloud 16y ago
        Just ask RTM.
geuis 16y ago
I just attempted to buy this app. Its already been removed from the app store. Bummer.
- jonah 16y ago
  wow! :( I attempted to buy it but it requires iOS 4. (I have a 2G...)
  - BRadmin 16y ago
    Tethering on Edge probably wouldn't be the best experience anyways. =)
deleted 16y ago
[deleted]
deleted 16y ago
[deleted]
comster 16y ago
badass app. What does this say about the app store?
markbao 16y ago
God damn, it's been removed. Serious bummer to wait until iPhone 4 jailbreak to get tethering.
Legion 16y ago
SOCKS proxy isn't really "tethering".
- brainsik 16y ago
  True, but if you are on OS X, most of the apps will use the System Preferences proxy settings, so most of your apps will Just Work. Of course, you'll have to get tricky to use SSH via the SOCKS proxy, but it can be done.
  - wallflower 16y ago
    SSH through a SOCKS 4/5 proxy: 1. Download and compile connect.c (http://www.taiyo.co.jp/~gotoh/ssh/connect.c http://www.taiyo.co.jp/~gotoh/ssh/connect.c or http://www.meadowy.org/~gotoh/ssh/connect.c http://www.meadowy.org/~gotoh/ssh/connect.c). gcc connect.c -o connect -lresolv 2. sudo cp connect /usr/local/bin/connect-proxy 3. cd ~/.ssh Add new config file as shown below (if existing, then be careful - backup/modify) File: ~/.ssh/config Host * ProxyCommand connect-proxy -R both -4 -S proxy:<proxy-port> %h %p 4. Test ssh to one of your hosts Note: If you're not using the proxy, you need to disable the global config with a script or something to nuke it on demand.
evandavid 16y ago
iPhone tethering is allowed on my carrier, but I got the app anyway because setting up an ad-hoc WiFi network will allow me to tether my iPhone to my iPad, as well as the fact that bluetooth tethering between Mac <--> iPhone is flaky as hell. Will be interesting to see if Apple kills it, and if they go as far as to kill it outside of the US where tethering is allowed anyway.
DenisM 16y ago
I wish he'd release the source, then those of us with dev accounts would be able to use it.
- gmurphy 16y ago
  Here's the source to one that doesn't require flashlight shenanegans: http://wiki.github.com/tcurdt/iProxy/ http://wiki.github.com/tcurdt/iProxy/
  - DenisM 16y ago
    thanks, gmurphy!
  - wallflower 16y ago
    And, no, it's not possible to modify it to run in the background like Pandora because background networking/radio kills battery life.
    - gojomo 16y ago
      Not directly, but -- if Pandora can make a fresh HTTP request out for each song-reload, could a not-quite-SOCKS proxy app make two outbound requests and relay traffic between them? Then, with some additional support on your laptop -- maybe just netcat in a loop -- things might work well enough for browsing. Or could some novel proxy otherwise keep alive a tunnel to another machine in the background? The latest iSSH app says it can keep a session alive for 10 minutes in the background -- though it's not clear if it can relay significant data while backgrounded.
      - wallflower 16y ago
        Looks like iSSH is using beginBackgroundTaskWithExpirationHandler. So, yes, it's possible it would run for up to 10 min. in the background but my guess is the watchdog would kill the SOCKS app for taking up too much CPU time for a bg process and/or network access would be killed intermittently. http://developer.apple.com/iphone/library/documentation/uikit/reference/UIApplication_Class/Reference/Reference.html http://developer.apple.com/iphone/library/documentation/uiki... "This method lets your application continue to run for a period of time after it transitions to the background."
fraXis 16y ago
I was able to get this app before it was removed. I followed the directions and it works perfectly on my Macbook Pro. However, it only works with Safari. It does not work with Chrome, Firefox, or any mail protocols (POP / IMAP / SMTP).
- wallflower 16y ago
  Without a server to tunnel ssh, it's not possible but with somr Apache/root server access, your best bet is tsocks which is not intuitive to get working. http://gigo.com/archives/tsocks-on-the-mac.html http://gigo.com/archives/tsocks-on-the-mac.html http://www.verot.net/socks.htm http://www.verot.net/socks.htm
- X-Istence 16y ago
  That is because Chrome and Firefox don't follow the system PROXY settings you will have to change those individually. Mail.app works over the global systems SOCKS proxy as such it works without any issues what so ever.

70 points by ajg1977 16y ago

I wonder how many other apps on Apple's "guaranteed-safe" App Store have hidden behavior like this? Since I can't actually audit the app code that runs on my device (like by compiling it myself), nor can I audit the OS, I guess I now have to assume that any application on my iPhone is compromised. (+) Apple should include a warning on the box to that effect. (+) I don't actually own an iPhone.

chc 16y ago
I feel pretty vindicated, because I've been saying all along that the App Store review process is pointless at best, because the things apps are usually rejected for are fairly petty and it has almost no way of picking up on anything but the dumbest malware.
- IgorPartola 16y ago
  I think that should be "the things that people make a huge fuss about are pretty petty." I think that the review process adds a certain value to the App Store. I know that if I download an app, (1) it will run and (2) it will do more or less what the description says. That is not to say that this is the one true way, but it adds value. I think a model that the web has followed is better: apps should be ranked based on some organic factors (e.g.: content of description + reviews) and the best apps can just float to the top. Security can be ensured via reviews/ratings + sandboxes access to phone's core functions.
  - chc 16y ago
    I think you may have misunderstood the term "petty." Even the rejections people don't make a fuss about are fairly petty for the most part (dictionary definition: "of little importance; trivial"). They're mostly things like "You forgot this one guideline" or "You have a small bug in this part of the app."
    - IgorPartola 16y ago
      Same as the Debian policy. That doesn't seem to be a big deal in that community. Are the guidelines for the the App Store? Does it seem okay to ship a product with known bugs? Admittedly, I've never gotten an app approved by Apple, but as an iPhone user I can appreciate these things.
      - Goladus 16y ago
        Well, ignoring for the moment that there's always some controversy with regards to contributions to Debian and other Linux distributions, Debian doesn't have an app store. If there is software you can't get using apt-get out of the box, for example, if you want the real firefox and not iceweasel, you might need to add a repository to your config file. Or maybe just wget a url and install a .deb file manually. Or you can just download the source and compile it yourself. Can't do any of that on the iPhone. It's the app store or you figure out some way to beat Apple's security.
        IgorPartola 16y ago
        My point with this is that while Apple is going about things the wrong way, they are in fact adding value. Simply removing the approval process and letting any app into the app store will be a bad thing.
wallflower 16y ago
Apps are sandboxed. They can send and receive data over http/https at will. Location sharing is much more audited in iOS 4. Your calendar data and some address book data is not well protected. Your pictures are only accessible through the camera roll UI; apps can't slurp them.
- maxjg 16y ago
  Your contacts are pretty much completely unprotected as well. As an iPhone developer myself, I don't think it's unreasonable to have the device ask for permission to use this data (in a similar manner as location data access is approved).
- ajg1977 16y ago
  Contacts (and in iOS 4, calendar data) are completely unprotected. Just create an instance of an AddressBook and go to town. Your pictures are only accessible through the camera roll UI... IF the developer is only using public APIs. Since we can assume that there are no public APIs that support tethering setup, we can also assume that it's still possible for them to be used in rogue apps and for developers to have access to private data.
  - pieter 16y ago
    You can make a perfectly fine SOCKS proxy without using any unpublished API's. It's just listening on one socket and then opening a new one based on the request.
  - bombs 16y ago
    It's possible to create a tethering app using public APIs. The APIs for HTTP/HTTPS connectivity and WiFi connectivity are public. Apple rejects apps that use private APIs.
    - tomjen3 16y ago
      How does Apple actually scan for private APIs? Couldn't you write the instructions necessary to make the private API call on the stack at runtime and then simply execute an assembly jump instruction?
jsz0 16y ago
Apple has never guaranteed the App Store is safe. They've pushed the idea that the App Store is safer than alternatives though. The iPhone EULA covers this.
tvon 16y ago
Well, that's pretty much the a basic OSS argument that's been around since day 1, just applied to a specific device.

donohoe 16y ago

If true, I guarantee that Apple will use their “kill switch” to remove this app from any iPhones that have it installed.

jmatt 16y ago
I bought NetShare when it was briefly on the app store and it still works. Or at least it did last time I was at my cabin a few months ago with my 3G. If they were going to kill an app, I'd assume they would have killed that. And they didn't. Or if they claimed to have killed it then they failed. I bought this app. I'm more than willing to support the the Rebellion. I haven't actually verified that this app works as demonstrated but for a dollar it's worth the risk. I have no intentions of paying another $20 a month to AT&T.
- jmatt 16y ago
  This may sound silly now, but a long time ago I bought myLite - an iphone flashlight app. And when the app starts it has a frustratingly long and dark splashscreen before you get the actual light. Even as a flash light HandyLight outperforms myLite. When I start it - it's immediate white.
- DLWormwood 16y ago
  > I bought this app. I'm more than willing to support the the Rebellion. I haven't actually verified that this app works as demonstrated but for a dollar it's worth the risk. I have no intentions of paying another $20 a month to AT&T. As a current iOS developer, I’ve always wondered what the financial repercussions of getting pulled from the App Store would be. I wouldn’t be surprised if Apple refused to pay the kid his post-commission cut from what he was able to sell due to this kind of hidden behavior.
  - bombs 16y ago
    The kid's under 18. You need to be 18 or over to sell apps in the App Store, as per the agreement. They could choose to pull his apps, remove his account and not pay him for that reason alone.

wallflower 16y ago

I wonder why this guy thought sacrificing his iPhone developer status was a good idea. If it gets 'remote killed', it was all for naught. Maybe he's going Droid. EDIT: He's just a kid > Hi, I'm Nick Lee, an aspiring 15-year-old web designer and programmer. I consider ...

alextgordon 16y ago
His app just hit the front pages of multiple high-traffic websites. It could well have been an excellent idea.
- glhaynes 16y ago
  Why? Does he have something else to sell? Assuming he doesn't, he's just put his effort into learning what could be a valuable skill, but now can't work on the platform (ever again?).
  - lsc 16y ago
    > Does he have something else to sell? himself. If he wants to get a regular job later /or/ if he wants to launch a product later, having his name in the headlines helps quite a lot. i don't want to say "there is no such thing as bad publicity" because there is, but in this case, enough people, I think, will feel that a tethering application is 'not evil' and that this was overall a good thing to make it a net win for the programmer. Even if apple blocks him forever (I don't know their history... would they really say "no, f-ck you" five years from now?) and even if the apple platform remains dominant (I will be very surprised if apple continues its dominance after Jobs runs out of spare parts.) there are plenty of companies that make iphone apps that I'm sure would be happy to hire the kid. And there are plenty of other platforms out there to work on, too.
    - waterlesscloud 16y ago
      Just ask RTM.

geuis 16y ago

I just attempted to buy this app. Its already been removed from the app store. Bummer.

jonah 16y ago
wow! :( I attempted to buy it but it requires iOS 4. (I have a 2G...)
- BRadmin 16y ago
  Tethering on Edge probably wouldn't be the best experience anyways. =)

deleted 16y ago

[deleted]

deleted 16y ago

[deleted]

comster 16y ago

badass app. What does this say about the app store?

markbao 16y ago

God damn, it's been removed. Serious bummer to wait until iPhone 4 jailbreak to get tethering.

Legion 16y ago

SOCKS proxy isn't really "tethering".

brainsik 16y ago
True, but if you are on OS X, most of the apps will use the System Preferences proxy settings, so most of your apps will Just Work. Of course, you'll have to get tricky to use SSH via the SOCKS proxy, but it can be done.
- wallflower 16y ago
  SSH through a SOCKS 4/5 proxy: 1. Download and compile connect.c (http://www.taiyo.co.jp/~gotoh/ssh/connect.c http://www.taiyo.co.jp/~gotoh/ssh/connect.c or http://www.meadowy.org/~gotoh/ssh/connect.c http://www.meadowy.org/~gotoh/ssh/connect.c). gcc connect.c -o connect -lresolv 2. sudo cp connect /usr/local/bin/connect-proxy 3. cd ~/.ssh Add new config file as shown below (if existing, then be careful - backup/modify) File: ~/.ssh/config Host * ProxyCommand connect-proxy -R both -4 -S proxy:<proxy-port> %h %p 4. Test ssh to one of your hosts Note: If you're not using the proxy, you need to disable the global config with a script or something to nuke it on demand.

evandavid 16y ago

iPhone tethering is allowed on my carrier, but I got the app anyway because setting up an ad-hoc WiFi network will allow me to tether my iPhone to my iPad, as well as the fact that bluetooth tethering between Mac <--> iPhone is flaky as hell. Will be interesting to see if Apple kills it, and if they go as far as to kill it outside of the US where tethering is allowed anyway.

DenisM 16y ago

I wish he'd release the source, then those of us with dev accounts would be able to use it.

gmurphy 16y ago
Here's the source to one that doesn't require flashlight shenanegans: http://wiki.github.com/tcurdt/iProxy/ http://wiki.github.com/tcurdt/iProxy/
- DenisM 16y ago
  thanks, gmurphy!
- wallflower 16y ago
  And, no, it's not possible to modify it to run in the background like Pandora because background networking/radio kills battery life.
  - gojomo 16y ago
    Not directly, but -- if Pandora can make a fresh HTTP request out for each song-reload, could a not-quite-SOCKS proxy app make two outbound requests and relay traffic between them? Then, with some additional support on your laptop -- maybe just netcat in a loop -- things might work well enough for browsing. Or could some novel proxy otherwise keep alive a tunnel to another machine in the background? The latest iSSH app says it can keep a session alive for 10 minutes in the background -- though it's not clear if it can relay significant data while backgrounded.
    - wallflower 16y ago
      Looks like iSSH is using beginBackgroundTaskWithExpirationHandler. So, yes, it's possible it would run for up to 10 min. in the background but my guess is the watchdog would kill the SOCKS app for taking up too much CPU time for a bg process and/or network access would be killed intermittently. http://developer.apple.com/iphone/library/documentation/uikit/reference/UIApplication_Class/Reference/Reference.html http://developer.apple.com/iphone/library/documentation/uiki... "This method lets your application continue to run for a period of time after it transitions to the background."

fraXis 16y ago

I was able to get this app before it was removed. I followed the directions and it works perfectly on my Macbook Pro. However, it only works with Safari. It does not work with Chrome, Firefox, or any mail protocols (POP / IMAP / SMTP).

wallflower 16y ago
Without a server to tunnel ssh, it's not possible but with somr Apache/root server access, your best bet is tsocks which is not intuitive to get working. http://gigo.com/archives/tsocks-on-the-mac.html http://gigo.com/archives/tsocks-on-the-mac.html http://www.verot.net/socks.htm http://www.verot.net/socks.htm
X-Istence 16y ago
That is because Chrome and Firefox don't follow the system PROXY settings you will have to change those individually. Mail.app works over the global systems SOCKS proxy as such it works without any issues what so ever.