6 ms·

Linking this next time somebody tries to tell me iOS's limitations on sideloading improve security. In reality it costs the bad guys $299 to bypass this limita

Linking this next time somebody tries to tell me iOS's limitations on sideloading improve security. In reality it costs the bad guys $299 to bypass this limitation, while your average user is locked out of this feature.

sandworm101 4y ago
Considering how much apple hardware costs, I find it difficult to believe that the average apple user wouldn't be able to scrape together 299$. That's about half the price of a budget iPhone in my area.
- cmeacham98 4y ago
  The current-gen iPhone SE (i.e. what you'd likely buy if you wanted a budget iPhone) costs $429 here in the US. Additionally, you often can get an even better deal if you're willing to sign a contract with a carrier. Even if I take your prices at face value, I'm not sure "Apple charges 1/2 the price of the phone to unlock sideloading" to be a killer argument.
- Closi 4y ago
  We aren't talking about the average user - this is the licence for a medium-sized enterprise licence to write/develop their own apps. You need to be a verified business to get this.
bfgoodrich 4y ago
> In reality it costs the bad guys $299 to bypass this limitation They also had to get verified as a mid-sized or greater corporation (Apple does use real verification partners), and further Apple can pull the rug on the certificate in an instant, immediately invaliding that $299 certificate and the considerable effort that went into getting it. In reality this group likely had to hack an existing Apple Enterprise approved business first, then using that to springboard to the next step. Casually dismissing that enormous gate is pretty tenuous.
- mike_d 4y ago
  I don't have any inside details on this case, but I highly suspect the signing certificate was stolen from a legitimate user. Organizations sophisticated enough to build something like this already target organizations like device manufactures to get kernel driver signing certificates on Windows.
joshstrange 4y ago
Installing an enterprise app requires the user trust the cert (with a scary warning shown). Also this makes a better case for not allowing sideloading since the sandboxing isn't perfect but the app store review process makes it harder to sneak one by. > In reality it costs the bad guys $299 to bypass this limitation And enterprise certs aren't so easy as "just give Apple $299", try and get one then get back to me.
- cmeacham98 4y ago
  > Also this makes a better case for not allowing sideloading since the sandboxing isn't perfect but the app store review process makes it harder to sneak one by. The point I'm trying to make is that Apple isn't consistent here. If they actually believed this to be true there would be no way to get a sideloading cert that worked on all devices. "Sideloading is dangerous because users could install malware" and "We'll let any iPhone sideload your app if you jump through some hoops and pay us" are incompatible statements, but Apple makes both of them. > And enterprise certs aren't so easy as "just give Apple $299", try and get one then get back to me. Obviously not, but the linked post demonstrates attackers are more than capable of getting one.
  - joshstrange 4y ago
    But surely you see the difference between "revokable enterprise cert that requires a verification process to obtain" and "anyone can sideload"? I don't see this as Apple making incompatible statements.
    - josephcsible 4y ago
      But the verification is obviously ineffective at stopping malware. If it were effective, then this wouldn't be a story.
      - mwint 4y ago
        Something can be simultaneously effective, and also fail at least once.
blakesterz 4y ago
> Linking this next time somebody tries to tell me iOS's limitations on sideloading improve security. While I wouldn't say that's exactly wrong, if this type of thing happened often I would think that we wouldn't see Google writing this up as interesting. Doesn't seeing this mean it is a rare and noteworthy event and more evidence that iOS's limitations on sideloading do improve security? I'm not sure how often this happens, so I could be way off.
rubynerd 4y ago
It's next to impossible to get the clearance for an Apple Developer Enterprise account unless you know someone at Apple. It's necessary to have an Enterprise account to sign MDM certificates, so I've had an application open for over six months without hearing from them, and the first application was rejected after 10 months without any dialogue. With this article shining yet more negative light on the program after the Facebook/Google spying-on-the-internet-access-of-kids debacle effectively shut the Enterprise program down, the MDM space will be even harder to innovate in, considering no startup will ever meet the required bar for signing up for an Enterprise account.
GeekyBear 4y ago
> Linking this next time somebody tries to tell me iOS's limitations on sideloading improve security. This IS a case of using an enterprise certificate to sideload an app. If anything, this proves that sideloading, even with scary warnings to the users, enables malware.

sandworm101 4y ago

Considering how much apple hardware costs, I find it difficult to believe that the average apple user wouldn't be able to scrape together 299$. That's about half the price of a budget iPhone in my area.

cmeacham98 4y ago
The current-gen iPhone SE (i.e. what you'd likely buy if you wanted a budget iPhone) costs $429 here in the US. Additionally, you often can get an even better deal if you're willing to sign a contract with a carrier. Even if I take your prices at face value, I'm not sure "Apple charges 1/2 the price of the phone to unlock sideloading" to be a killer argument.
Closi 4y ago
We aren't talking about the average user - this is the licence for a medium-sized enterprise licence to write/develop their own apps. You need to be a verified business to get this.

bfgoodrich 4y ago

> In reality it costs the bad guys $299 to bypass this limitation They also had to get verified as a mid-sized or greater corporation (Apple does use real verification partners), and further Apple can pull the rug on the certificate in an instant, immediately invaliding that $299 certificate and the considerable effort that went into getting it. In reality this group likely had to hack an existing Apple Enterprise approved business first, then using that to springboard to the next step. Casually dismissing that enormous gate is pretty tenuous.

mike_d 4y ago
I don't have any inside details on this case, but I highly suspect the signing certificate was stolen from a legitimate user. Organizations sophisticated enough to build something like this already target organizations like device manufactures to get kernel driver signing certificates on Windows.

joshstrange 4y ago

Installing an enterprise app requires the user trust the cert (with a scary warning shown). Also this makes a better case for not allowing sideloading since the sandboxing isn't perfect but the app store review process makes it harder to sneak one by. > In reality it costs the bad guys $299 to bypass this limitation And enterprise certs aren't so easy as "just give Apple $299", try and get one then get back to me.

cmeacham98 4y ago
> Also this makes a better case for not allowing sideloading since the sandboxing isn't perfect but the app store review process makes it harder to sneak one by. The point I'm trying to make is that Apple isn't consistent here. If they actually believed this to be true there would be no way to get a sideloading cert that worked on all devices. "Sideloading is dangerous because users could install malware" and "We'll let any iPhone sideload your app if you jump through some hoops and pay us" are incompatible statements, but Apple makes both of them. > And enterprise certs aren't so easy as "just give Apple $299", try and get one then get back to me. Obviously not, but the linked post demonstrates attackers are more than capable of getting one.
- joshstrange 4y ago
  But surely you see the difference between "revokable enterprise cert that requires a verification process to obtain" and "anyone can sideload"? I don't see this as Apple making incompatible statements.
  - josephcsible 4y ago
    But the verification is obviously ineffective at stopping malware. If it were effective, then this wouldn't be a story.
    - mwint 4y ago
      Something can be simultaneously effective, and also fail at least once.

blakesterz 4y ago

> Linking this next time somebody tries to tell me iOS's limitations on sideloading improve security. While I wouldn't say that's exactly wrong, if this type of thing happened often I would think that we wouldn't see Google writing this up as interesting. Doesn't seeing this mean it is a rare and noteworthy event and more evidence that iOS's limitations on sideloading do improve security? I'm not sure how often this happens, so I could be way off.

rubynerd 4y ago

It's next to impossible to get the clearance for an Apple Developer Enterprise account unless you know someone at Apple. It's necessary to have an Enterprise account to sign MDM certificates, so I've had an application open for over six months without hearing from them, and the first application was rejected after 10 months without any dialogue. With this article shining yet more negative light on the program after the Facebook/Google spying-on-the-internet-access-of-kids debacle effectively shut the Enterprise program down, the MDM space will be even harder to innovate in, considering no startup will ever meet the required bar for signing up for an Enterprise account.

GeekyBear 4y ago

> Linking this next time somebody tries to tell me iOS's limitations on sideloading improve security. This IS a case of using an enterprise certificate to sideload an app. If anything, this proves that sideloading, even with scary warnings to the users, enables malware.