5 ms·

What do you think iOS reviewers were thinking when carefully auditing these apps - https://mashable.com/2017/06/12/apple-app-store-subcription-scams/ https://m

What do you think iOS reviewers were thinking when carefully auditing these apps - https://mashable.com/2017/06/12/apple-app-store-subcription-scams/ https://mashable.com/2017/06/12/apple-app-store-subcription-... https://9to5mac.com/2019/10/25/malware-iphone-apps/ https://9to5mac.com/2019/10/25/malware-iphone-apps/ https://www.techtimes.com/articles/235985/20181204/apple-removes-malicious-fitness-apps-that-tricked-users-to-make-touch-id-payments.htm https://www.techtimes.com/articles/235985/20181204/apple-rem... https://www.wired.com/2015/09/apple-removes-300-infected-apps-app-store/ https://www.wired.com/2015/09/apple-removes-300-infected-app... They get so much wrong, so often, you have to wonder if they really look at the apps at all or just have some checklist, screenshots and a quota to hit. They explicitly approved all the garbage practices that Apple Arcade's billing protects users from.

simlevesque 7y ago
> just have some checklist, screenshots and a quota to hit From my own app review experience, this is all they do.
dkonofalski 7y ago
That doesn't feel like the same thing at all. A shady developer tricking people into a subscription because they don't know any better is way different from malware that reinstalls itself even after a factory reset. People have to agree to pay for the subscription from an OS-level prompt in the first instance. They don't have a choice in the 2nd.
- ikt 7y ago
  > A shady developer tricking people into a subscription because they don't know any better is way different from malware that reinstalls itself even after a factory reset. A shady developer tricking people and a shady website tricking people result in bad things. To get this trojan I'd need to go into settings and tick this box: https://q3fb03rfy3f4ahuzu2uy6e11-wpengine.netdna-ssl.com/wp-content/uploads/2016/03/sideload-android-apps.png https://q3fb03rfy3f4ahuzu2uy6e11-wpengine.netdna-ssl.com/wp-... Then go to the dodgy website, then download the apk, then install it then pikachu face when I get a trojan. And you can talk about how great Apple's security is but to fix this issue all Google has to do is remove that tick box in settings so no more sideloading apps. But that also comes back with drawbacks that I assume an Apple user like yourself wouldn't know about, because all you know is a walled garden. Sort of like how Chinese people love the fact their internet is censored. So safe, so secure.
  - dkonofalski 7y ago
    >I assume an Apple user like yourself wouldn't know about Yes, truly... because there's no way that someone who uses an iPhone might know about the existence of Android/Windows/Linux/macOS or any other system that allows for sideloading and/or installing un-certed apps. The point is, even if Apple allowed sideloading, there's no way that the iOS sandbox model would allow for what's being described here. The comparison wasn't accurate. Your condescension and ignorance doesn't help that argument at all.
  - Aaargh20318 7y ago
    > And you can talk about how great Apple's security is but to fix this issue all Google has to do is remove that tick box in settings so no more sideloading apps. And yet, they don’t. > But that also comes back with drawbacks that I assume an Apple user like yourself wouldn't know about, because all you know is a walled garden. Funny how Android users keep saying that. I’m an Android developer by profession, which is why I use an iPhone as my personal phone and would never recommend an Android device even to my worst enemy. I’ve seen how the sausage is made and it isn’t pretty. The best thing you can say about Android is that it’s free, which correctly reflects what it’s worth.
varenc 7y ago
That's different. Apple's capricious app store review policy aside, iOS is so locked down that even a completely malicious sideloaded* iOS app can't dig itself into the system like this. Without a local privilege escalation exploit there's just no way to set up a persistent background service and no way to escape the sandboxing to allow an app to leave a mark on the system after your app is uninstalled. (*a developer can basically sideload any app on their iOS device with an Apple developer license)
deleted 7y ago
[deleted]
elliekelly 7y ago
If shady devs can get a malicious app past Apple they can definitely get one past the average user. Does Apple get it right 100% of the time? Of course not. Does Apple get it right far more often than I would? Without a doubt.
- rurp 7y ago
  Getting a malicious app past Apple in this context might mean as little as getting past a cursory review from a single indifferent employee. Apple has let enough bad apps through that, without further information, my default assumption is that the reviewer is doing little more than checking some boxes.

simlevesque 7y ago

> just have some checklist, screenshots and a quota to hit From my own app review experience, this is all they do.

dkonofalski 7y ago

That doesn't feel like the same thing at all. A shady developer tricking people into a subscription because they don't know any better is way different from malware that reinstalls itself even after a factory reset. People have to agree to pay for the subscription from an OS-level prompt in the first instance. They don't have a choice in the 2nd.

ikt 7y ago
> A shady developer tricking people into a subscription because they don't know any better is way different from malware that reinstalls itself even after a factory reset. A shady developer tricking people and a shady website tricking people result in bad things. To get this trojan I'd need to go into settings and tick this box: https://q3fb03rfy3f4ahuzu2uy6e11-wpengine.netdna-ssl.com/wp-content/uploads/2016/03/sideload-android-apps.png https://q3fb03rfy3f4ahuzu2uy6e11-wpengine.netdna-ssl.com/wp-... Then go to the dodgy website, then download the apk, then install it then pikachu face when I get a trojan. And you can talk about how great Apple's security is but to fix this issue all Google has to do is remove that tick box in settings so no more sideloading apps. But that also comes back with drawbacks that I assume an Apple user like yourself wouldn't know about, because all you know is a walled garden. Sort of like how Chinese people love the fact their internet is censored. So safe, so secure.
- dkonofalski 7y ago
  >I assume an Apple user like yourself wouldn't know about Yes, truly... because there's no way that someone who uses an iPhone might know about the existence of Android/Windows/Linux/macOS or any other system that allows for sideloading and/or installing un-certed apps. The point is, even if Apple allowed sideloading, there's no way that the iOS sandbox model would allow for what's being described here. The comparison wasn't accurate. Your condescension and ignorance doesn't help that argument at all.
- Aaargh20318 7y ago
  > And you can talk about how great Apple's security is but to fix this issue all Google has to do is remove that tick box in settings so no more sideloading apps. And yet, they don’t. > But that also comes back with drawbacks that I assume an Apple user like yourself wouldn't know about, because all you know is a walled garden. Funny how Android users keep saying that. I’m an Android developer by profession, which is why I use an iPhone as my personal phone and would never recommend an Android device even to my worst enemy. I’ve seen how the sausage is made and it isn’t pretty. The best thing you can say about Android is that it’s free, which correctly reflects what it’s worth.

varenc 7y ago

That's different. Apple's capricious app store review policy aside, iOS is so locked down that even a completely malicious sideloaded* iOS app can't dig itself into the system like this. Without a local privilege escalation exploit there's just no way to set up a persistent background service and no way to escape the sandboxing to allow an app to leave a mark on the system after your app is uninstalled. (*a developer can basically sideload any app on their iOS device with an Apple developer license)

deleted 7y ago

[deleted]

elliekelly 7y ago

If shady devs can get a malicious app past Apple they can definitely get one past the average user. Does Apple get it right 100% of the time? Of course not. Does Apple get it right far more often than I would? Without a doubt.

rurp 7y ago
Getting a malicious app past Apple in this context might mean as little as getting past a cursory review from a single indifferent employee. Apple has let enough bad apps through that, without further information, my default assumption is that the reviewer is doing little more than checking some boxes.