3 ms·
Plenty of us know about the private Enterprise branded app stores that any company can create, they just have to have a Mobile Device Manager certificate and ha
by bradknowles 5y ago
Plenty of us know about the private Enterprise branded app stores that any company can create, they just have to have a Mobile Device Manager certificate and have bought the right type of Enterprise developer certificate.
And yet these Enterprise app stores are still a target for malware developers, because most people don’t understand what it means to install certificates, and once their certificate is installed, the rest is easy. Even the notarization is relatively easy.
Bang — you’ve got your own malware App Store, and now your grandmother can finally install her favorite recipes or game apps. And meanwhile, the malware App Store can install anything else they like on her device.
This is a real threat. It has actually happened before. And there are plenty of malware authors out there that are trying the same thing on a regular basis.
You just don’t hear about this sort of thing very often, because Apple doesn’t talk about it very often.
- Apocryphon 5y agoWhat’s the hard numbers for the scope of this threat? What are the case studies of prior instances of enterprise certificate store exploits? The threat vector of third party app stores, whether from rival FANG big companies or from phantom enterprise cert app stores, still makes assumptions on user behavior. Good luck getting even tech enthusiasts to be quick to jumping on rival app stores, and dealing with the whole rigamarole of setting up new memberships, payment accounts, and purchase histories. Much less the so-called “grandma” demographic. The App Store would still be preeminent even if iOS was to open up to sideloading. Simple consumer behavior would prevent masses of users from departing from a system that’s over a decade old. Thus that vector is mitigated.