6 ms·

The developers, e.g. for WeChat, downloaded a copy of Xcode, not from Apple, but from a random third party, and when they ran it had to click through warnings a

The developers, e.g. for WeChat, downloaded a copy of Xcode, not from Apple, but from a random third party, and when they ran it had to click through warnings about it being unsigned. Then TenCent uploaded their now hacked WeChat, compiled with the hacked Xcode, signed by them, to the AppStore. This is not Apple’s fault. This is on TenCent and the other developers who did this. The list of hacked Apps was published by Apple and linked to in the article.

ctvo 5y ago
> This is not Apple’s fault This is a lot to unpack. Let me narrow it down here: - Developers submit app to AppStore - Apple scans it, manually reviews it, certifies it meets security, privacy, and quality guidelines - Apple allows users to download the app from the AppStore - Users assume apps on the AppStore are secure because Apple loudly proclaims this - Users are infected with malware And this isn't Apple's fault? Of course this isn’t a tenable position for Apple. There’s no way to catch everything. But they market this, and use it as justification for their walled garden.
- onedognight 5y ago
  > There’s no way to catch everything. But they market this, and use it as justification for their walled garden. This is a valid point, and also the reason this particular attack is so interesting. Apple's system relies on holding people/companies accountable for submitting malware. Apple has the power to knock a company out of the App Store, so the company is incentivized to not push the limits. This hack is an attack directly on this relationship-based system. It's an attack on Apple's ability to punish. This doesn't make Apple's system worthless, just worth less.
  - dannyw 5y ago
    No, if Apple is taking 30%, they should be doing random bytecode level analysis of apps to make sure there's n hidden malware.
- judge2020 5y ago
  > - Users are infected with malware Also, it was less malware and more just a low-profile privacy invasive SDK.

ctvo 5y ago

> This is not Apple’s fault This is a lot to unpack. Let me narrow it down here: - Developers submit app to AppStore - Apple scans it, manually reviews it, certifies it meets security, privacy, and quality guidelines - Apple allows users to download the app from the AppStore - Users assume apps on the AppStore are secure because Apple loudly proclaims this - Users are infected with malware And this isn't Apple's fault? Of course this isn’t a tenable position for Apple. There’s no way to catch everything. But they market this, and use it as justification for their walled garden.

onedognight 5y ago
> There’s no way to catch everything. But they market this, and use it as justification for their walled garden. This is a valid point, and also the reason this particular attack is so interesting. Apple's system relies on holding people/companies accountable for submitting malware. Apple has the power to knock a company out of the App Store, so the company is incentivized to not push the limits. This hack is an attack directly on this relationship-based system. It's an attack on Apple's ability to punish. This doesn't make Apple's system worthless, just worth less.
- dannyw 5y ago
  No, if Apple is taking 30%, they should be doing random bytecode level analysis of apps to make sure there's n hidden malware.
judge2020 5y ago
> - Users are infected with malware Also, it was less malware and more just a low-profile privacy invasive SDK.