15 ms·
It's being noticed in the biggest similar ecosystem, too, so by that logic it should be noticed in both if it is present in both Sorry, but how does discoverin
by moe 16y ago
It's being noticed in the biggest similar ecosystem, too, so by that logic it should be noticed in both if it is present in both
Sorry, but how does discovering one instance of malware in the android market imply that any instance in the iOS Store will be discovered at the same time? Is there some sort of quantum-link that I'm missing?
The Apple review process is present in iOS.
I was told the Apple review process does not involve a full code analysis. And even if it did, malware authors are known to be quite creative in hiding their payloads.
Apps you have installed might or might not already contain shell-code embedded into seemingly innocent images or assets, with very little chance of detection.
I'm not a security researcher or blackhat. But under the premise that you can (afaik) not root a phone without the user noticing, my strategy for pulling off an attack would be a sleeper-strategy. I'd first seed my payload silently, and then pull the trigger all at once, at some point in the future.
Moreover, considering there has been a one-click safari jailbreak[1], you may not even need to embed actual malware in an app. It may be enough to be able to remotely instruct the app to load a specific URL at your command - now how's that for an attack vector.
So, technically there is no difference between doing either on android or doing it on iOS.
If you still want to claim otherwise then you should come up with a better argument than "but apple has a review process!".
[1] http://lifehacker.com/#!316287/jailbreak-your-iphone-or-ipod-touch-with-one-click http://lifehacker.com/#!316287/jailbreak-your-iphone-or-ipod...
- ceejayoz 16y ago> Sorry, but how does discovering one instance of malware in the android market imply that all instances in the iOS Store will be discovered at the same time? Twofold: this is not the only incidence of malicious software on Android, and I never made the claim that all instances should necessarily be immediately found - just that, if it's as easy to slip in as the OP claimed, that SOMETHING should've been found by now.
- moe 16y agoSOMETHING should've been found by now Well, I'm working about as hard as PG. No, actually I work much harder. I SHOULD have found the one startup-idea by now that takes off and makes me as wealthy as him! Notice the flaw in your reasoning? There is no correlation.
- ceejayoz 16y agoFinding a great startup idea and detecting malicious software are vastly different things. If inserting malware into iOS is simple, it would be done, and done widely. If done widely, the chances are very good that someone would've detected it in at least one such application.
- moe 16y agoFinding a great startup idea and detecting malicious software are vastly different things. Oh, you think so? Both are a function of skill, heuristics, sweat - and a great deal of luck. If inserting malware into iOS is simple... I'm not sure how I could make it any clearer, perhaps look at some of the other threads on this article? So I'll just repeat: iOS is not different to Android with regard to malware. Long version: The difference is so small as to be negligible. I'm not sure I understand why that is such a bitter pill to swallow for some people.
- ceejayoz 16y ago> iOS is not different to Android with regard to malware. Then why is malware being identified on Android but not iOS?