4 ms·

I mean accidental in the sense that the developer was not acting in bad faith. I don’t mean to defend Apple, it just annoys me that this is advertised as an iPh

• xmprt 5y ago
  Apple is claiming that their App Store is secure and rigorous. If developers (maliciously or not) were able to add code like this to their apps then doesn't that mean someone was able to hack the App Store verification process? And if they were, is it not Apple's responsibility to inform their users that their devices might have malicious apps?
  • katbyte 5y ago
    That it happened is not a valid data point, it should be compared to other stores and what % are malicious apps. Now not disclosing it is on them but at the same time, it was the apps who were hacked and I can see it falling to them to disclose?
    • cj 5y ago
      Does Apple give app developers an avenue to communicate security incidents to people downloading free apps if the app doesn’t require signing up with an email address? Does that line of communication remain open after the app is deleted on the device?
  • toast0 5y ago
    What was added to the App code wasn't outside the bounds of acceptable code in apps, as far as I can tell. But maybe I missed something? It just took some data from allowed phone APIs and sent it to a server, which is allowed. And maybe opened some other apps through deeplinking, which is also allowed. How is a reviewer to know that the code in the app wasn't put there intentionally by the developer? Maybe force everything through DNS and include a list of domains in the app submission. You might be surprised at how many people can connect when you include an IP in the app that couldn't connect via DNS though; if your user base is big enough, it adds up.