6 ms·

You can slip the malware in as a timebomb. It's not exactly as easy as it is with Android or an open platform, but it is almost as easy.

by sid0 16y ago

ceejayoz 16y ago
Why aren't we seeing it happen, then?
- joebananas 16y ago
  It's much easier to spread FUD on the internet than to actually do it.
- moe 16y ago
  How do you know it isn't already happening? Do you monitor the outgoing traffic from your cellphone?
  - ceejayoz 16y ago
    > How do you know it isn't already happening? There is no evidence that it is happening, with plenty of security researchers and interested amateurs keeping their eyes open for it. There's nothing special about iOS that prevents you from discovering this sort of app behaviour that isn't present on Android.
    - moe 16y ago
      There is no evidence that it is happening You mean other than seeing it happen in the biggest similar ecosystem? There's nothing special about iOS [...] that isn't present on Android Exactly. So why should iOS be different with regard to malware then?
      - ceejayoz 16y ago
        > You mean other than seeing it happen in the biggest similar ecosystem? It's being noticed in the biggest similar ecosystem, too, so by that logic it should be noticed in both if it is present in both. > Exactly. So why should iOS be different with regard to malware then? The Apple review process is present in iOS. The process to market is markedly different.
        moe 16y ago
        It's being noticed in the biggest similar ecosystem, too, so by that logic it should be noticed in both if it is present in both Sorry, but how does discovering one instance of malware in the android market imply that any instance in the iOS Store will be discovered at the same time? Is there some sort of quantum-link that I'm missing? The Apple review process is present in iOS. I was told the Apple review process does not involve a full code analysis. And even if it did, malware authors are known to be quite creative in hiding their payloads. Apps you have installed might or might not already contain shell-code embedded into seemingly innocent images or assets, with very little chance of detection. I'm not a security researcher or blackhat. But under the premise that you can (afaik) not root a phone without the user noticing, my strategy for pulling off an attack would be a sleeper-strategy. I'd first seed my payload silently, and then pull the trigger all at once, at some point in the future. Moreover, considering there has been a one-click safari jailbreak[1], you may not even need to embed actual malware in an app. It may be enough to be able to remotely instruct the app to load a specific URL at your command - now how's that for an attack vector. So, technically there is no difference between doing either on android or doing it on iOS. If you still want to claim otherwise then you should come up with a better argument than "but apple has a review process!". [1] http://lifehacker.com/#!316287/jailbreak-your-iphone-or-ipod-touch-with-one-click http://lifehacker.com/#!316287/jailbreak-your-iphone-or-ipod...
        ceejayoz 16y ago
        > Sorry, but how does discovering one instance of malware in the android market imply that all instances in the iOS Store will be discovered at the same time? Twofold: this is not the only incidence of malicious software on Android, and I never made the claim that all instances should necessarily be immediately found - just that, if it's as easy to slip in as the OP claimed, that SOMETHING should've been found by now.
    - nl 16y ago
      The threat is not theoretical. Several iPhone apps have been pulled from the App Store after being found to be harvesting user data, intentionally or unintentionally. A game called Aurora Feint was uploading all the user contacts to the developer's server, and salespeople from Swiss road traffic information app MogoRoad were calling customers who downloaded the app. Game app Storm8 was sued last fall for allegedly harvesting customer phone numbers without permission, but it later stopped that practice. And users also complained that Pinch Media, an analytics framework used by developers, was collecting data about customer phones. http://news.cnet.com/8301-27080_3-10446402-245.html http://news.cnet.com/8301-27080_3-10446402-245.html
mrcharles 16y ago
This is one thing I've been wondering about, how is it that they don't know every single API call the executable is linked to? I know that Objective C and messaging is different from function linking in some fashion, but certainly there must be a way of determining if disallowed APIs are ever called, at all, without just using the app and hoping you trap them. I think at the very least they should be able to examine the executable for object types used, and function signatures used, as well as determining what signatures are passed to which objects.
- jedsmith 16y ago
  > This is one thing I've been wondering about, how is it that they don't know every single API call the executable is linked to? They do. I used an old example from the Internet, and that API was now private; Apple rejected the app and included the name of the API that I wasn't supposed to use.
  - sid0 16y ago
    But you were being honest in your use of the API.
jedsmith 16y ago
Are you speaking from experience?
- sid0 16y ago
  No, from logic. I don't have a Mac to develop on, sorry.
  - mkramlich 16y ago
    I think you're both right in different ways. The positions "if it can happen it has or will" versus "yes but there is no evidence so it probably hasn't or won't" both have merit and are not explicitly in conflict. But I'm reminded of that quote: "In theory there is no difference between theory and practice. In practice there almost always is!"
nhangen 16y ago
So how is that more dangerous?
- sid0 16y ago
  It gives users a false sense of security. The average user is far more willing to trust an arbitrary iPhone application than an arbitrary Windows application, do you not agree?
  - nhangen 16y ago
    No, I don't really. I don't think those with a high level of technical intelligence will be affected by wall or wall-less, while those with less than moderate TI probably don't even realize that one marketplace has or doesn't have an approval process. So it's equally dangerous, but I don't think moreso.
    - sid0 16y ago
      You have people talking in this very thread about a walled garden being better: http://news.ycombinator.com/item?id=2279823 http://news.ycombinator.com/item?id=2279823
      - danssig 16y ago
        A walled garden is unquestionably better. It isn't fool proof but it's the same situation as security: you can't make your system completely secure but you can make it more secure than the next guy. The Android store is the next guy.

You can slip the malware in as a timebomb. It's not exactly as easy as it is with Android or an open platform, but it is almost as easy.

by sid0 16y ago

You can slip the malware in as a timebomb. It's not exactly as easy as it is with Android or an open platform, but it is almost as easy.

ceejayoz 16y ago

Why aren't we seeing it happen, then?

joebananas 16y ago
It's much easier to spread FUD on the internet than to actually do it.
moe 16y ago
How do you know it isn't already happening? Do you monitor the outgoing traffic from your cellphone?
- ceejayoz 16y ago
  > How do you know it isn't already happening? There is no evidence that it is happening, with plenty of security researchers and interested amateurs keeping their eyes open for it. There's nothing special about iOS that prevents you from discovering this sort of app behaviour that isn't present on Android.
  - moe 16y ago
    There is no evidence that it is happening You mean other than seeing it happen in the biggest similar ecosystem? There's nothing special about iOS [...] that isn't present on Android Exactly. So why should iOS be different with regard to malware then?
    - ceejayoz 16y ago
      > You mean other than seeing it happen in the biggest similar ecosystem? It's being noticed in the biggest similar ecosystem, too, so by that logic it should be noticed in both if it is present in both. > Exactly. So why should iOS be different with regard to malware then? The Apple review process is present in iOS. The process to market is markedly different.
      - moe 16y ago
        It's being noticed in the biggest similar ecosystem, too, so by that logic it should be noticed in both if it is present in both Sorry, but how does discovering one instance of malware in the android market imply that any instance in the iOS Store will be discovered at the same time? Is there some sort of quantum-link that I'm missing? The Apple review process is present in iOS. I was told the Apple review process does not involve a full code analysis. And even if it did, malware authors are known to be quite creative in hiding their payloads. Apps you have installed might or might not already contain shell-code embedded into seemingly innocent images or assets, with very little chance of detection. I'm not a security researcher or blackhat. But under the premise that you can (afaik) not root a phone without the user noticing, my strategy for pulling off an attack would be a sleeper-strategy. I'd first seed my payload silently, and then pull the trigger all at once, at some point in the future. Moreover, considering there has been a one-click safari jailbreak[1], you may not even need to embed actual malware in an app. It may be enough to be able to remotely instruct the app to load a specific URL at your command - now how's that for an attack vector. So, technically there is no difference between doing either on android or doing it on iOS. If you still want to claim otherwise then you should come up with a better argument than "but apple has a review process!". [1] http://lifehacker.com/#!316287/jailbreak-your-iphone-or-ipod-touch-with-one-click http://lifehacker.com/#!316287/jailbreak-your-iphone-or-ipod...
        ceejayoz 16y ago
        > Sorry, but how does discovering one instance of malware in the android market imply that all instances in the iOS Store will be discovered at the same time? Twofold: this is not the only incidence of malicious software on Android, and I never made the claim that all instances should necessarily be immediately found - just that, if it's as easy to slip in as the OP claimed, that SOMETHING should've been found by now.
  - nl 16y ago
    The threat is not theoretical. Several iPhone apps have been pulled from the App Store after being found to be harvesting user data, intentionally or unintentionally. A game called Aurora Feint was uploading all the user contacts to the developer's server, and salespeople from Swiss road traffic information app MogoRoad were calling customers who downloaded the app. Game app Storm8 was sued last fall for allegedly harvesting customer phone numbers without permission, but it later stopped that practice. And users also complained that Pinch Media, an analytics framework used by developers, was collecting data about customer phones. http://news.cnet.com/8301-27080_3-10446402-245.html http://news.cnet.com/8301-27080_3-10446402-245.html

mrcharles 16y ago

This is one thing I've been wondering about, how is it that they don't know every single API call the executable is linked to? I know that Objective C and messaging is different from function linking in some fashion, but certainly there must be a way of determining if disallowed APIs are ever called, at all, without just using the app and hoping you trap them. I think at the very least they should be able to examine the executable for object types used, and function signatures used, as well as determining what signatures are passed to which objects.

jedsmith 16y ago
> This is one thing I've been wondering about, how is it that they don't know every single API call the executable is linked to? They do. I used an old example from the Internet, and that API was now private; Apple rejected the app and included the name of the API that I wasn't supposed to use.
- sid0 16y ago
  But you were being honest in your use of the API.

jedsmith 16y ago

Are you speaking from experience?

sid0 16y ago
No, from logic. I don't have a Mac to develop on, sorry.
- mkramlich 16y ago
  I think you're both right in different ways. The positions "if it can happen it has or will" versus "yes but there is no evidence so it probably hasn't or won't" both have merit and are not explicitly in conflict. But I'm reminded of that quote: "In theory there is no difference between theory and practice. In practice there almost always is!"

nhangen 16y ago

So how is that more dangerous?

sid0 16y ago
It gives users a false sense of security. The average user is far more willing to trust an arbitrary iPhone application than an arbitrary Windows application, do you not agree?
- nhangen 16y ago
  No, I don't really. I don't think those with a high level of technical intelligence will be affected by wall or wall-less, while those with less than moderate TI probably don't even realize that one marketplace has or doesn't have an approval process. So it's equally dangerous, but I don't think moreso.
  - sid0 16y ago
    You have people talking in this very thread about a walled garden being better: http://news.ycombinator.com/item?id=2279823 http://news.ycombinator.com/item?id=2279823
    - danssig 16y ago
      A walled garden is unquestionably better. It isn't fool proof but it's the same situation as security: you can't make your system completely secure but you can make it more secure than the next guy. The Android store is the next guy.