4 ms·

Wait, why is this Apple’s fault? > The infections were the result of legitimate developers writing apps using a counterfeit copy of Xcode, Apple’s iOS and OS X

by harikb 5y ago

Wait, why is this Apple’s fault? > The infections were the result of legitimate developers writing apps using a counterfeit copy of Xcode, Apple’s iOS and OS X app development tool. The repackaged tool dubbed XcodeGhost surreptitiously inserted malicious code alongside normal app functions. This was shown by Ken Thompson is 1984 I thought [1] 1. http://wiki.c2.com/?TheKenThompsonHack http://wiki.c2.com/?TheKenThompsonHack

josephcsible 5y ago
The breach wasn't Apple's fault, but the cover-up is.
- deleted 5y ago
  [deleted]
Siira 5y ago
Why was there a counterfeit Xcode in the first place? Reminds me of how hard it is to download Xcode with the crappy App Store when not having the connection Apple engineers enjoy ...
- katbyte 5y ago
  Because “it downloaded faster in China” apparently?
lazide 5y ago
Besides it maybe not being Apple’s fault (except for not telling anyone) - it is maybe Apple’s fault because they explicitly state they are reviewing apps, and did not catch this issue. So they obviously have a huge blind spot and their customers were impacted because of it. Considering the scope and scale of the App Store and the massive revenues from it, it is also pretty hard to believe some better scanning or analysis software wouldn’t have caught this pre-emptively? Since I remember the ‘Apple was not doing true binary level review’ coming up when I talked to an iOS developer literally a decade ago about the App Store (back in Android 1.1 SDK days) - he even mentioned this type of attack as a possibility - and they obviously haven’t changed that, there are probably a ton more like this out there that have slipped under the radar due to smaller scope, or less clear impact.
- harikb 5y ago
  Short of Apple proxying and reviewing every byte sent out by an app, I just don’t see how this level of review is possible. It is like detecting virus or malware. Whether apple should have boasted about their review process or not is another matter. There is no technology we have today, whether it is mobile, server side, Linux kernel or whatever that accepts random code from strangers (that is what you doing with pirated s/w) and detects intentionally written malicious code.
  - josephcsible 5y ago
    The point is that Apple pretends that there is such a thing, but that it only works if they have a walled garden.
  - FireBeyond 5y ago
    Sure. And what prevented Apple from telling those users their security had been compromised? Not much beyond a desire to not make a lie of their "curated, secure walled garden" PR.

by harikb 5y ago

josephcsible 5y ago

The breach wasn't Apple's fault, but the cover-up is.

deleted 5y ago
[deleted]

Siira 5y ago

Why was there a counterfeit Xcode in the first place? Reminds me of how hard it is to download Xcode with the crappy App Store when not having the connection Apple engineers enjoy ...

katbyte 5y ago
Because “it downloaded faster in China” apparently?

lazide 5y ago

Besides it maybe not being Apple’s fault (except for not telling anyone) - it is maybe Apple’s fault because they explicitly state they are reviewing apps, and did not catch this issue. So they obviously have a huge blind spot and their customers were impacted because of it. Considering the scope and scale of the App Store and the massive revenues from it, it is also pretty hard to believe some better scanning or analysis software wouldn’t have caught this pre-emptively? Since I remember the ‘Apple was not doing true binary level review’ coming up when I talked to an iOS developer literally a decade ago about the App Store (back in Android 1.1 SDK days) - he even mentioned this type of attack as a possibility - and they obviously haven’t changed that, there are probably a ton more like this out there that have slipped under the radar due to smaller scope, or less clear impact.

harikb 5y ago
Short of Apple proxying and reviewing every byte sent out by an app, I just don’t see how this level of review is possible. It is like detecting virus or malware. Whether apple should have boasted about their review process or not is another matter. There is no technology we have today, whether it is mobile, server side, Linux kernel or whatever that accepts random code from strangers (that is what you doing with pirated s/w) and detects intentionally written malicious code.
- josephcsible 5y ago
  The point is that Apple pretends that there is such a thing, but that it only works if they have a walled garden.
- FireBeyond 5y ago
  Sure. And what prevented Apple from telling those users their security had been compromised? Not much beyond a desire to not make a lie of their "curated, secure walled garden" PR.