5 ms·
The article is about apple failing to detect a huge number of apps that accidentally contained malware. I would not call this an iPhone hack though.
by superjan 5y ago
The article is about apple failing to detect a huge number of apps that accidentally contained malware. I would not call this an iPhone hack though.
- djmips 5y agoProbably it's this kind of thinking that allowed for such a thing to occur. Not all gates were equally secure.
- pmontra 5y agoNot accidentally. A malicious third party version of XCode injected the malware into the apps and Apple's vetting system failed to detect it. Apple eventually discovered it and decided not to warn its customers.
- superjan 5y agoI mean accidental in the sense that the developer was not acting in bad faith. I don’t mean to defend Apple, it just annoys me that this is advertised as an iPhone hack.
- xmprt 5y agoApple is claiming that their App Store is secure and rigorous. If developers (maliciously or not) were able to add code like this to their apps then doesn't that mean someone was able to hack the App Store verification process? And if they were, is it not Apple's responsibility to inform their users that their devices might have malicious apps?
- katbyte 5y agoThat it happened is not a valid data point, it should be compared to other stores and what % are malicious apps. Now not disclosing it is on them but at the same time, it was the apps who were hacked and I can see it falling to them to disclose?
- cj 5y agoDoes Apple give app developers an avenue to communicate security incidents to people downloading free apps if the app doesn’t require signing up with an email address? Does that line of communication remain open after the app is deleted on the device?
- toast0 5y agoWhat was added to the App code wasn't outside the bounds of acceptable code in apps, as far as I can tell. But maybe I missed something? It just took some data from allowed phone APIs and sent it to a server, which is allowed. And maybe opened some other apps through deeplinking, which is also allowed. How is a reviewer to know that the code in the app wasn't put there intentionally by the developer? Maybe force everything through DNS and include a list of domains in the app submission. You might be surprised at how many people can connect when you include an IP in the app that couldn't connect via DNS though; if your user base is big enough, it adds up.
- gruez 5y agoIf this was swapped out for microsoft or google, would it be fair to call it the windows/android hack?
- treesprite82 5y agoIf a comparable number of Xboxes were compromised through a game on Microsoft's own Xbox store then I would say that's an Xbox hack. It'd mean that the malware evaded the Xbox's security mechanisms (which are implemented at Microsoft's end when publishing onto the store). For non-walled-garden platforms, like most desktop operating systems, a program being available for download isn't yet a bypass of any security feature. It'd have to do something forbidden like privilege escalation for me to count it as a OSX/Windows/Linux hack.
- Dah00n 5y agoIf Microsoft in numerous court cases had said the reason for the walked garden is because it is safe, then yes. But only Apple says that. This is not comparable to downloading for Windows but more like downloading malware from the Xbox or PlayStation store. Apple approved those apps.
- vbezhenar 5y agoDid they at least disable those apps on affected phones until upgraded? Or this hack was not dangerous?