9 ms·

I know IOS isn't perfect, however, when I read articles like this, I just have to smile. There's something to be said for a tightly controlled platform and ecos

by redm 7y ago

I know IOS isn't perfect, however, when I read articles like this, I just have to smile. There's something to be said for a tightly controlled platform and ecosystem.

benologist 7y ago
What do you think iOS reviewers were thinking when carefully auditing these apps - https://mashable.com/2017/06/12/apple-app-store-subcription-scams/ https://mashable.com/2017/06/12/apple-app-store-subcription-... https://9to5mac.com/2019/10/25/malware-iphone-apps/ https://9to5mac.com/2019/10/25/malware-iphone-apps/ https://www.techtimes.com/articles/235985/20181204/apple-removes-malicious-fitness-apps-that-tricked-users-to-make-touch-id-payments.htm https://www.techtimes.com/articles/235985/20181204/apple-rem... https://www.wired.com/2015/09/apple-removes-300-infected-apps-app-store/ https://www.wired.com/2015/09/apple-removes-300-infected-app... They get so much wrong, so often, you have to wonder if they really look at the apps at all or just have some checklist, screenshots and a quota to hit. They explicitly approved all the garbage practices that Apple Arcade's billing protects users from.
- simlevesque 7y ago
  > just have some checklist, screenshots and a quota to hit From my own app review experience, this is all they do.
- dkonofalski 7y ago
  That doesn't feel like the same thing at all. A shady developer tricking people into a subscription because they don't know any better is way different from malware that reinstalls itself even after a factory reset. People have to agree to pay for the subscription from an OS-level prompt in the first instance. They don't have a choice in the 2nd.
  - ikt 7y ago
    > A shady developer tricking people into a subscription because they don't know any better is way different from malware that reinstalls itself even after a factory reset. A shady developer tricking people and a shady website tricking people result in bad things. To get this trojan I'd need to go into settings and tick this box: https://q3fb03rfy3f4ahuzu2uy6e11-wpengine.netdna-ssl.com/wp-content/uploads/2016/03/sideload-android-apps.png https://q3fb03rfy3f4ahuzu2uy6e11-wpengine.netdna-ssl.com/wp-... Then go to the dodgy website, then download the apk, then install it then pikachu face when I get a trojan. And you can talk about how great Apple's security is but to fix this issue all Google has to do is remove that tick box in settings so no more sideloading apps. But that also comes back with drawbacks that I assume an Apple user like yourself wouldn't know about, because all you know is a walled garden. Sort of like how Chinese people love the fact their internet is censored. So safe, so secure.
    - dkonofalski 7y ago
      >I assume an Apple user like yourself wouldn't know about Yes, truly... because there's no way that someone who uses an iPhone might know about the existence of Android/Windows/Linux/macOS or any other system that allows for sideloading and/or installing un-certed apps. The point is, even if Apple allowed sideloading, there's no way that the iOS sandbox model would allow for what's being described here. The comparison wasn't accurate. Your condescension and ignorance doesn't help that argument at all.
    - Aaargh20318 7y ago
      > And you can talk about how great Apple's security is but to fix this issue all Google has to do is remove that tick box in settings so no more sideloading apps. And yet, they don’t. > But that also comes back with drawbacks that I assume an Apple user like yourself wouldn't know about, because all you know is a walled garden. Funny how Android users keep saying that. I’m an Android developer by profession, which is why I use an iPhone as my personal phone and would never recommend an Android device even to my worst enemy. I’ve seen how the sausage is made and it isn’t pretty. The best thing you can say about Android is that it’s free, which correctly reflects what it’s worth.
- varenc 7y ago
  That's different. Apple's capricious app store review policy aside, iOS is so locked down that even a completely malicious sideloaded* iOS app can't dig itself into the system like this. Without a local privilege escalation exploit there's just no way to set up a persistent background service and no way to escape the sandboxing to allow an app to leave a mark on the system after your app is uninstalled. (*a developer can basically sideload any app on their iOS device with an Apple developer license)
- deleted 7y ago
  [deleted]
- elliekelly 7y ago
  If shady devs can get a malicious app past Apple they can definitely get one past the average user. Does Apple get it right 100% of the time? Of course not. Does Apple get it right far more often than I would? Without a doubt.
  - rurp 7y ago
    Getting a malicious app past Apple in this context might mean as little as getting past a cursory review from a single indifferent employee. Apple has let enough bad apps through that, without further information, my default assumption is that the reviewer is doing little more than checking some boxes.
bobviolier 7y ago
To be fair, if you stick to just using the Google Play Store, _this_ malware wouldn't hit you. > According to Malwarebytes, the source of these infections is "web redirects" that send users to web pages hosting Android apps. These sites instruct users on how to side-load unofficial Android apps from outside the Play Store. Code hidden in these apps downloads the xHelper trojan.
- hello_friendos 7y ago
  Maybe not this malware, but there is other malware on the Play Store. https://www.digitaltrends.com/mobile/google-play-store-malware-hits-42-apps-with-8-million-downloads/ https://www.digitaltrends.com/mobile/google-play-store-malwa...
  - stjohnswarts 7y ago
    Of course there is, just like on the Apple web store.
    - afro88 7y ago
      Links please
      - zik 7y ago
        There are some just above in this thread.
        dkonofalski 7y ago
        Those aren't links to malware. Those are links to stories about malware that was removed from the App Store. Kinda makes the opposite point of what you're implying, doesn't it?
      - Godel_unicode 7y ago
        https://www.wired.com/story/apple-app-store-malware-click-fraud/ https://www.wired.com/story/apple-app-store-malware-click-fr... https://us.norton.com/internetsecurity-emerging-threats-ios-malware-xcodeghost-infects-millions-of-apple-store-customers.html https://us.norton.com/internetsecurity-emerging-threats-ios-...
dclusin 7y ago
It seems like they could get a better outcome by having levels of trust for unsanctioned apps. Like the default for side-loaded apps would be just as an app only. No background processing, notifications, loading services. To get the latter functionality you could make the user jump through a bunch of hoops with nasty warning messages or even just not allow it.
- m4rtink 7y ago
  Note that if you enforce this for all side loaded apps are turning Android closer to the walled garden that is iOS. There are already many legitimate apps distributed outside of Google Play for various reasons, such as weird Google policies or simply being booted out with no or spurious reason & the developer not being able to ever reach a human to fix this. So be careful what you wish for.
  - dclusin 7y ago
    I wish apple would allow side loaded apps. I'm not saying eliminate side loaded apps all together. Merely, it seems like its a binary view. Either allow side loaded apps and make no attempt to design the installation process with security features, or deny un-approved applications entirely in the name of security. I think Apple's desktop solution to unverified developers is a good way to split the difference. Deny by default but allow whitelisting. They go even further under the privacy tab and only allow certain applications permission to access accessibility features or full disk access, etc.
  - jabbany 7y ago
    This actually seems broadly similar to the issue with "self-XSS" and the developer console in browsers (which is hidden behind a couple of menus). So far most of the mitigations involve the site printing messages into the console telling users to not paste in anything here unless they are a developer. Maybe it's a good idea to hide the "Allow sideloaded apps" under the developer menu in Android or something, or generally to display a scarier message.
    - 7y ago
GetOutOfBed 7y ago
Are you smiling because people who chose other options than you are having issues?
- tinus_hn 7y ago
  The people who made choices that enable these issues, while complaining about other options that prevent these issues?
  - jessaustin 7y ago
    One needn't badmouth iOS in order to use Android. Indeed, many who use Android don't know that iOS exists.
    - aloknnikhil 7y ago
      Or cannot afford an iPhone. Android brought smartphones to the masses. It's a lack of choice at that price point.
    - GetOutOfBed 7y ago
      I think a large part of "the older generation" doesn't even understand that smartphones have software running on them called "android". My mom calls her Samsung Galaxy "iphone".
ActorNightly 7y ago
Sure, except that once you get past the idea of trusting others for your security, and instead learning and securing stuff yourself, you quickly realize that "tightly controlled" is just a synonym for "you don't really own your device, we just let you use it how we see fit". As so recently demonstrated by Apples ability to remove the HKmap.live app. In general really wonder why people still defend Apple these days. Even if you overlook a combination of stuff like infinite attempts for icloud logins that led to the Fappening, their role in HK protests, and of course their pretty terrible labor practices that go so far as even to supposedly break the Chinese labor laws (which is a feat in itself), there is still issues with stuff they produce. Their hardware and software quality has been on a hard decline, especially if you compare it to alternatives rather than on its own merit. They don't really innovate despite opposite marketing claims, and they still participate in this "technology as a jewelry" thing with their $1000 monitor stands.
- scarface74 7y ago
  So how do you “secure yourself” - besides having a device that runs an OS that doesn’t allow these types of exploits in the first place?
  - jackewiehose 7y ago
    Installing custom software is neither an exploit nor a type of it.
    - scarface74 7y ago
      Are you saying that people meant to install the malware?
      - jackewiehose 7y ago
        They certainly didn't know it was malware but yes, according to the article they installed the software intentionally (they even had to do extra steps and follow instructions on a random website to circumvent the google store).
sekasi 7y ago
I don't know why you're being downvoted. You've got a point. There's no perfection in the App Store when it comes to review, but it's an ecosystem that is built around trying to create a sense of control and privacy. Sorry if you don't disagree but I reckon facts overwhelmingly disagree with you if you do. That's not to say in any way ANDROID BAD or anything like that, it's just a broader attack vector that you're up against with Android unless you're a very careful experienced customer. Most people aren't. :/
- jackewiehose 7y ago
  I didn't downvote but I understand why others did (I would have if it wasn't already grey). It's incredibly frustrating to read these pro-walled-garden-arguments. By the same argument you could say that the people in Hong Kong or elsewhere should just shut up and accept that their leaders will know what's best for them. I worry about a future where these locked-down devices will be the norm for all of us. Don't defend Apple for locking you in. That's ridiculous.
  - edmundsauto 7y ago
    The analogy isn't useful because you're comparing a government to a corporation.
    - jackewiehose 7y ago
      Of course it's not the same but it comes down to a party that wants to restrict your freedom in order to protect you.
      - edmundsauto 7y ago
        One crucial difference is whether you can opt-out. Another big difference is the stated intention of the party/entity: i.e. Apple is not a company "of the people, by the people, and for the people". My objection is that it's not that useful to only look at whether a party wants to restrict freedom. Personally, I don't think that's a very useful dimension at all -- I don't consider the existence of a road limiting to my freedom to drive wherever I feel like it.

by redm 7y ago

I know IOS isn't perfect, however, when I read articles like this, I just have to smile. There's something to be said for a tightly controlled platform and ecosystem.

benologist 7y ago

What do you think iOS reviewers were thinking when carefully auditing these apps - https://mashable.com/2017/06/12/apple-app-store-subcription-scams/ https://mashable.com/2017/06/12/apple-app-store-subcription-... https://9to5mac.com/2019/10/25/malware-iphone-apps/ https://9to5mac.com/2019/10/25/malware-iphone-apps/ https://www.techtimes.com/articles/235985/20181204/apple-removes-malicious-fitness-apps-that-tricked-users-to-make-touch-id-payments.htm https://www.techtimes.com/articles/235985/20181204/apple-rem... https://www.wired.com/2015/09/apple-removes-300-infected-apps-app-store/ https://www.wired.com/2015/09/apple-removes-300-infected-app... They get so much wrong, so often, you have to wonder if they really look at the apps at all or just have some checklist, screenshots and a quota to hit. They explicitly approved all the garbage practices that Apple Arcade's billing protects users from.

simlevesque 7y ago
> just have some checklist, screenshots and a quota to hit From my own app review experience, this is all they do.
dkonofalski 7y ago
That doesn't feel like the same thing at all. A shady developer tricking people into a subscription because they don't know any better is way different from malware that reinstalls itself even after a factory reset. People have to agree to pay for the subscription from an OS-level prompt in the first instance. They don't have a choice in the 2nd.
- ikt 7y ago
  > A shady developer tricking people into a subscription because they don't know any better is way different from malware that reinstalls itself even after a factory reset. A shady developer tricking people and a shady website tricking people result in bad things. To get this trojan I'd need to go into settings and tick this box: https://q3fb03rfy3f4ahuzu2uy6e11-wpengine.netdna-ssl.com/wp-content/uploads/2016/03/sideload-android-apps.png https://q3fb03rfy3f4ahuzu2uy6e11-wpengine.netdna-ssl.com/wp-... Then go to the dodgy website, then download the apk, then install it then pikachu face when I get a trojan. And you can talk about how great Apple's security is but to fix this issue all Google has to do is remove that tick box in settings so no more sideloading apps. But that also comes back with drawbacks that I assume an Apple user like yourself wouldn't know about, because all you know is a walled garden. Sort of like how Chinese people love the fact their internet is censored. So safe, so secure.
  - dkonofalski 7y ago
    >I assume an Apple user like yourself wouldn't know about Yes, truly... because there's no way that someone who uses an iPhone might know about the existence of Android/Windows/Linux/macOS or any other system that allows for sideloading and/or installing un-certed apps. The point is, even if Apple allowed sideloading, there's no way that the iOS sandbox model would allow for what's being described here. The comparison wasn't accurate. Your condescension and ignorance doesn't help that argument at all.
  - Aaargh20318 7y ago
    > And you can talk about how great Apple's security is but to fix this issue all Google has to do is remove that tick box in settings so no more sideloading apps. And yet, they don’t. > But that also comes back with drawbacks that I assume an Apple user like yourself wouldn't know about, because all you know is a walled garden. Funny how Android users keep saying that. I’m an Android developer by profession, which is why I use an iPhone as my personal phone and would never recommend an Android device even to my worst enemy. I’ve seen how the sausage is made and it isn’t pretty. The best thing you can say about Android is that it’s free, which correctly reflects what it’s worth.
varenc 7y ago
That's different. Apple's capricious app store review policy aside, iOS is so locked down that even a completely malicious sideloaded* iOS app can't dig itself into the system like this. Without a local privilege escalation exploit there's just no way to set up a persistent background service and no way to escape the sandboxing to allow an app to leave a mark on the system after your app is uninstalled. (*a developer can basically sideload any app on their iOS device with an Apple developer license)
deleted 7y ago
[deleted]
elliekelly 7y ago
If shady devs can get a malicious app past Apple they can definitely get one past the average user. Does Apple get it right 100% of the time? Of course not. Does Apple get it right far more often than I would? Without a doubt.
- rurp 7y ago
  Getting a malicious app past Apple in this context might mean as little as getting past a cursory review from a single indifferent employee. Apple has let enough bad apps through that, without further information, my default assumption is that the reviewer is doing little more than checking some boxes.

bobviolier 7y ago

To be fair, if you stick to just using the Google Play Store, _this_ malware wouldn't hit you. > According to Malwarebytes, the source of these infections is "web redirects" that send users to web pages hosting Android apps. These sites instruct users on how to side-load unofficial Android apps from outside the Play Store. Code hidden in these apps downloads the xHelper trojan.

hello_friendos 7y ago
Maybe not this malware, but there is other malware on the Play Store. https://www.digitaltrends.com/mobile/google-play-store-malware-hits-42-apps-with-8-million-downloads/ https://www.digitaltrends.com/mobile/google-play-store-malwa...
- stjohnswarts 7y ago
  Of course there is, just like on the Apple web store.
  - afro88 7y ago
    Links please
    - zik 7y ago
      There are some just above in this thread.
      - dkonofalski 7y ago
        Those aren't links to malware. Those are links to stories about malware that was removed from the App Store. Kinda makes the opposite point of what you're implying, doesn't it?
    - Godel_unicode 7y ago
      https://www.wired.com/story/apple-app-store-malware-click-fraud/ https://www.wired.com/story/apple-app-store-malware-click-fr... https://us.norton.com/internetsecurity-emerging-threats-ios-malware-xcodeghost-infects-millions-of-apple-store-customers.html https://us.norton.com/internetsecurity-emerging-threats-ios-...

dclusin 7y ago

It seems like they could get a better outcome by having levels of trust for unsanctioned apps. Like the default for side-loaded apps would be just as an app only. No background processing, notifications, loading services. To get the latter functionality you could make the user jump through a bunch of hoops with nasty warning messages or even just not allow it.

m4rtink 7y ago
Note that if you enforce this for all side loaded apps are turning Android closer to the walled garden that is iOS. There are already many legitimate apps distributed outside of Google Play for various reasons, such as weird Google policies or simply being booted out with no or spurious reason & the developer not being able to ever reach a human to fix this. So be careful what you wish for.
- dclusin 7y ago
  I wish apple would allow side loaded apps. I'm not saying eliminate side loaded apps all together. Merely, it seems like its a binary view. Either allow side loaded apps and make no attempt to design the installation process with security features, or deny un-approved applications entirely in the name of security. I think Apple's desktop solution to unverified developers is a good way to split the difference. Deny by default but allow whitelisting. They go even further under the privacy tab and only allow certain applications permission to access accessibility features or full disk access, etc.
- jabbany 7y ago
  This actually seems broadly similar to the issue with "self-XSS" and the developer console in browsers (which is hidden behind a couple of menus). So far most of the mitigations involve the site printing messages into the console telling users to not paste in anything here unless they are a developer. Maybe it's a good idea to hide the "Allow sideloaded apps" under the developer menu in Android or something, or generally to display a scarier message.
  - 7y ago

GetOutOfBed 7y ago

Are you smiling because people who chose other options than you are having issues?

tinus_hn 7y ago
The people who made choices that enable these issues, while complaining about other options that prevent these issues?
- jessaustin 7y ago
  One needn't badmouth iOS in order to use Android. Indeed, many who use Android don't know that iOS exists.
  - aloknnikhil 7y ago
    Or cannot afford an iPhone. Android brought smartphones to the masses. It's a lack of choice at that price point.
  - GetOutOfBed 7y ago
    I think a large part of "the older generation" doesn't even understand that smartphones have software running on them called "android". My mom calls her Samsung Galaxy "iphone".

ActorNightly 7y ago

Sure, except that once you get past the idea of trusting others for your security, and instead learning and securing stuff yourself, you quickly realize that "tightly controlled" is just a synonym for "you don't really own your device, we just let you use it how we see fit". As so recently demonstrated by Apples ability to remove the HKmap.live app. In general really wonder why people still defend Apple these days. Even if you overlook a combination of stuff like infinite attempts for icloud logins that led to the Fappening, their role in HK protests, and of course their pretty terrible labor practices that go so far as even to supposedly break the Chinese labor laws (which is a feat in itself), there is still issues with stuff they produce. Their hardware and software quality has been on a hard decline, especially if you compare it to alternatives rather than on its own merit. They don't really innovate despite opposite marketing claims, and they still participate in this "technology as a jewelry" thing with their $1000 monitor stands.

scarface74 7y ago
So how do you “secure yourself” - besides having a device that runs an OS that doesn’t allow these types of exploits in the first place?
- jackewiehose 7y ago
  Installing custom software is neither an exploit nor a type of it.
  - scarface74 7y ago
    Are you saying that people meant to install the malware?
    - jackewiehose 7y ago
      They certainly didn't know it was malware but yes, according to the article they installed the software intentionally (they even had to do extra steps and follow instructions on a random website to circumvent the google store).

sekasi 7y ago

I don't know why you're being downvoted. You've got a point. There's no perfection in the App Store when it comes to review, but it's an ecosystem that is built around trying to create a sense of control and privacy. Sorry if you don't disagree but I reckon facts overwhelmingly disagree with you if you do. That's not to say in any way ANDROID BAD or anything like that, it's just a broader attack vector that you're up against with Android unless you're a very careful experienced customer. Most people aren't. :/

jackewiehose 7y ago
I didn't downvote but I understand why others did (I would have if it wasn't already grey). It's incredibly frustrating to read these pro-walled-garden-arguments. By the same argument you could say that the people in Hong Kong or elsewhere should just shut up and accept that their leaders will know what's best for them. I worry about a future where these locked-down devices will be the norm for all of us. Don't defend Apple for locking you in. That's ridiculous.
- edmundsauto 7y ago
  The analogy isn't useful because you're comparing a government to a corporation.
  - jackewiehose 7y ago
    Of course it's not the same but it comes down to a party that wants to restrict your freedom in order to protect you.
    - edmundsauto 7y ago
      One crucial difference is whether you can opt-out. Another big difference is the stated intention of the party/entity: i.e. Apple is not a company "of the people, by the people, and for the people". My objection is that it's not that useful to only look at whether a party wants to restrict freedom. Personally, I don't think that's a very useful dimension at all -- I don't consider the existence of a road limiting to my freedom to drive wherever I feel like it.