5 ms·

Installing an enterprise app requires the user trust the cert (with a scary warning shown). Also this makes a better case for not allowing sideloading since the

Installing an enterprise app requires the user trust the cert (with a scary warning shown). Also this makes a better case for not allowing sideloading since the sandboxing isn't perfect but the app store review process makes it harder to sneak one by. > In reality it costs the bad guys $299 to bypass this limitation And enterprise certs aren't so easy as "just give Apple $299", try and get one then get back to me.

cmeacham98 4y ago
> Also this makes a better case for not allowing sideloading since the sandboxing isn't perfect but the app store review process makes it harder to sneak one by. The point I'm trying to make is that Apple isn't consistent here. If they actually believed this to be true there would be no way to get a sideloading cert that worked on all devices. "Sideloading is dangerous because users could install malware" and "We'll let any iPhone sideload your app if you jump through some hoops and pay us" are incompatible statements, but Apple makes both of them. > And enterprise certs aren't so easy as "just give Apple $299", try and get one then get back to me. Obviously not, but the linked post demonstrates attackers are more than capable of getting one.
- joshstrange 4y ago
  But surely you see the difference between "revokable enterprise cert that requires a verification process to obtain" and "anyone can sideload"? I don't see this as Apple making incompatible statements.
  - josephcsible 4y ago
    But the verification is obviously ineffective at stopping malware. If it were effective, then this wouldn't be a story.
    - mwint 4y ago
      Something can be simultaneously effective, and also fail at least once.
      - smoldesu 4y ago
        Sure, but as soon as you have that single failure, your system isn't flawless anymore. Apple's claims of comprehensive security are repeatedly proved wrong, and social engineering attacks like this indicate that their attack surface is larger than one might have initially realized.
        reaperducer 4y ago
        Sure, but as soon as you have that single failure, your system isn't flawless anymore. I've never seen Apple claim that its system is flawless. Do you have a link?
    - mh8h 4y ago
      The thing is that when the system is effective at stoping the malware, you don't get a signal about it. You only see the ones that somehow made it. So it's not easy to have an idea of the effectiveness.
  - cmeacham98 4y ago
    Of course, I'll admit it will stop small-time attackers that aren't willing to pay $299, register a fake company, and whatever else is needed to trick Apple into letting you into the enterprise dev program. But I'd like to propose these attackers wouldn't have been able to bypass the sandbox anyways. I'm sure the fact this setup forces all apps to go through Apple's app store and pay them 30% of their revenue is just a unfortunate accident. My point is that if Apple truly believed sideloading was a risk to user security there wouldn't be certificates that let you sideload on all devices. They would force companies to provide a list of devices or only allow devices enrolled in their MDM or some similar reasonable restriction.
    - acdha 4y ago
      > I'm sure the fact this setup forces all apps to go through Apple's app store and pay them 30% of their revenue is just a unfortunate accident. Does a normal enterprise charge its users to install internal apps? If not, this seems like an odd complaint. > My point is that if Apple truly believed sideloading was a risk to user security there wouldn't be certificates that let you sideload on all devices. They would force companies to provide a list of devices or only allow devices enrolled in their MDM or some similar reasonable restriction. That last part is effectively what they're doing: you have to do the same level of scary prompt and authentication to install an enterprise certificate as you do to enroll for MDM. Yes, users can still be socially engineered to compromise their device but that's an order of magnitude harder than just convincing someone to run some random binary.
      - Apocryphon 4y ago
        Apple can easily create a guarded sideloading experience replete with scary warnings. They can shape the sideloading UX to screen out users who aren't ready for it. Critics of iOS sideloading fail to see that Apple can add as many guards and guided experiences into sideloading as it does with its other features, such as installing enterprise certs. Even on Android with its openness and notoriety for security issues, to sideload APKs means having to navigate multiple settings menus to get to it, which screens out the majority of non-technical users. Though that is more playing to the "strength" of that platform (clunky design and unwieldiness), which Apple would not be doing.
  - zamalek 4y ago
    To a layman? No difference at all. Remember that Apple claim to be the saviors of the ignorant.
- gumby 4y ago
  > The point I'm trying to make is that Apple isn't consistent here. If they actually believed this to be true there would be no way to get a sideloading cert that worked on all devices. Indeed. I'm (maybe) willing to sideload an app from my employer but not from some other company. Perhaps only managed devices should have this capability, and only for apps signed by the managing authority. I won't allow my employer to manage my personal phone; they have to issue me a phone if they want that kind of control. And in that case it's their device; they are welcome to manage it as they see fit. Also: this is different from TestFlight.
- tshaddox 4y ago
  > "Sideloading is dangerous because users could install malware" and "We'll let any iPhone sideload your app if you jump through some hoops and pay us" are incompatible statements, but Apple makes both of them. I'm missing how these are incompatible statements. You might as well say "if Apple thought certain apps could be dangerous they wouldn't have an App Store or even allow their own first-party apps on iPhones." Of course the position of Apple is that they should be able to approve every app/vendor before it's allowed to be installed on iPhones. The fact that they do approve some apps and vendors isn't incompatible with their position.
mcculley 4y ago
The warning looks like this: https://support.apple.com/library/content/dam/edam/applecare/images/en_US/iOS/iphone6-ios9-enterprise-untrusted_enterprise_app.png https://support.apple.com/library/content/dam/edam/applecare... EDIT: Formerly I asked: What does the scary warning look like? Is there a screenshot of an example? I would like to show this to my employees and family and tell them never to trust such a cert.
- dylan604 4y ago
  At least it doesn't have "Accept Anyways" type of button. The only option is to cancel whatever it was being attempted.
  - jtbayly 4y ago
    So how do you install it?
    - joshstrange 4y ago
      Here is the full flow: https://imgur.com/a/ofvfty8 https://imgur.com/a/ofvfty8
      - dylan604 4y ago
        Who does this kind of app install, and what do these kinds of apps promise that makes this sound like it is worth doing?
        joshstrange 4y ago
        I believe I remember reading about Google or FB having an app for employees to order food from the cafeteria as well as apps for internal tools/build pipelines/etc. While some POS apps like Square are in the app store there are others that are distributed through enterprise apps. It allows companies to push updates faster when/if something goes wrong. I also know (at least in the past) NetJets used enterprise apps for their pilots, the apps had the flight manual among other things if I remember correctly. Often it's custom or white labeled software that benefits from enterprise distribution. EDIT: Also if an organization is large enough TestFlight might not be suitable to cover everything they need. For example you might want nightly developer builds, weekly/milestone internal test builds, stagings builds, and then TestFlight and release. You can accomplish this with multiple apps that are never released (My App - Dev, My App - QA) so you can use TestFlight for each and then only release the production "My App" but that has some sharp edges and requires everyone be added to the Apple development team.
Dagonfly 4y ago
> but the app store review process makes it harder to sneak one by. Imo the key question is: If you can find an exploit in the iOS sandbox, will the app store review really stop you? Compared to the expertise required to find such an exploit, it should be pretty trivial to obfuscate it or load the payload remotely after install.
- duskwuff 4y ago
  > Imo the key question is: If you can find an exploit in the iOS sandbox, will the app store review really stop you? The App Store review is two-pronged -- it includes some human QA testing, and it also includes some automated screening of your executable, which includes checking for any suspicious library imports or strings. (This sometimes trips up applications which happen to use method names which happen to match up with Apple's internal APIs.) While it isn't entirely impossible for a malicious application to slip past this examination, it's significantly harder than for an Enterprise application which doesn't go through this process at all.
  - saagarjha 4y ago
    App Store Review’s automated scanning is quite trivial to get around, most iOS developers can either attest to doing so themselves or knowing someone who has done this.
aaomidi 4y ago
Well people are being trained to install this due to MDM.
easrng 4y ago
You can buy enterprise certs from other companies, that's how the stores like jailbreaks.fun (safe) or AppValley or AppCake (very questionable) get them.
tshaddox 4y ago
I couldn't agree with you more. I certainly see some very valid arguments for why Apple should allow sideloading on iPhones, but I am baffled by this extremely common argument that goes "here's an example of Apple not being restrictive enough to protect people, therefore Apple shouldn't be restrictive at all."
- nickff 4y ago
  You're observing 'motivated reasoning', where someone started with the result (Apple is wrong to disallow side-loading), and came up with a way to support it.
jrochkind1 4y ago
> And enterprise certs aren't so easy as "just give Apple $299", try and get one then get back to me. I believe you, but... so how does a "commercial spyware" company get one, and has it been cancelled by Apple after they see what they are up to? Or do their not-so-easy requirements... allow "commercial spyware" companies to fraudulently impersonate other apps with the cert?
- LocalH 4y ago
  I know there have been several independent "signing services" driven by these type of enterprise certs, and usually when Apple finds out that they've been used like this, they'll revoke them. The only real time I've personally ran into this is when I was away from my computer for an extended period of time and needed to reinstall the on-device jailbreak app (which would have been unc0ver).
usrn 4y ago
There's malware on the AppStore. The review process is completely incapable of catching it.

cmeacham98 4y ago

> Also this makes a better case for not allowing sideloading since the sandboxing isn't perfect but the app store review process makes it harder to sneak one by. The point I'm trying to make is that Apple isn't consistent here. If they actually believed this to be true there would be no way to get a sideloading cert that worked on all devices. "Sideloading is dangerous because users could install malware" and "We'll let any iPhone sideload your app if you jump through some hoops and pay us" are incompatible statements, but Apple makes both of them. > And enterprise certs aren't so easy as "just give Apple $299", try and get one then get back to me. Obviously not, but the linked post demonstrates attackers are more than capable of getting one.

joshstrange 4y ago
But surely you see the difference between "revokable enterprise cert that requires a verification process to obtain" and "anyone can sideload"? I don't see this as Apple making incompatible statements.
- josephcsible 4y ago
  But the verification is obviously ineffective at stopping malware. If it were effective, then this wouldn't be a story.
  - mwint 4y ago
    Something can be simultaneously effective, and also fail at least once.
    - smoldesu 4y ago
      Sure, but as soon as you have that single failure, your system isn't flawless anymore. Apple's claims of comprehensive security are repeatedly proved wrong, and social engineering attacks like this indicate that their attack surface is larger than one might have initially realized.
      - reaperducer 4y ago
        Sure, but as soon as you have that single failure, your system isn't flawless anymore. I've never seen Apple claim that its system is flawless. Do you have a link?
  - mh8h 4y ago
    The thing is that when the system is effective at stoping the malware, you don't get a signal about it. You only see the ones that somehow made it. So it's not easy to have an idea of the effectiveness.
- cmeacham98 4y ago
  Of course, I'll admit it will stop small-time attackers that aren't willing to pay $299, register a fake company, and whatever else is needed to trick Apple into letting you into the enterprise dev program. But I'd like to propose these attackers wouldn't have been able to bypass the sandbox anyways. I'm sure the fact this setup forces all apps to go through Apple's app store and pay them 30% of their revenue is just a unfortunate accident. My point is that if Apple truly believed sideloading was a risk to user security there wouldn't be certificates that let you sideload on all devices. They would force companies to provide a list of devices or only allow devices enrolled in their MDM or some similar reasonable restriction.
  - acdha 4y ago
    > I'm sure the fact this setup forces all apps to go through Apple's app store and pay them 30% of their revenue is just a unfortunate accident. Does a normal enterprise charge its users to install internal apps? If not, this seems like an odd complaint. > My point is that if Apple truly believed sideloading was a risk to user security there wouldn't be certificates that let you sideload on all devices. They would force companies to provide a list of devices or only allow devices enrolled in their MDM or some similar reasonable restriction. That last part is effectively what they're doing: you have to do the same level of scary prompt and authentication to install an enterprise certificate as you do to enroll for MDM. Yes, users can still be socially engineered to compromise their device but that's an order of magnitude harder than just convincing someone to run some random binary.
    - Apocryphon 4y ago
      Apple can easily create a guarded sideloading experience replete with scary warnings. They can shape the sideloading UX to screen out users who aren't ready for it. Critics of iOS sideloading fail to see that Apple can add as many guards and guided experiences into sideloading as it does with its other features, such as installing enterprise certs. Even on Android with its openness and notoriety for security issues, to sideload APKs means having to navigate multiple settings menus to get to it, which screens out the majority of non-technical users. Though that is more playing to the "strength" of that platform (clunky design and unwieldiness), which Apple would not be doing.
- zamalek 4y ago
  To a layman? No difference at all. Remember that Apple claim to be the saviors of the ignorant.
gumby 4y ago
> The point I'm trying to make is that Apple isn't consistent here. If they actually believed this to be true there would be no way to get a sideloading cert that worked on all devices. Indeed. I'm (maybe) willing to sideload an app from my employer but not from some other company. Perhaps only managed devices should have this capability, and only for apps signed by the managing authority. I won't allow my employer to manage my personal phone; they have to issue me a phone if they want that kind of control. And in that case it's their device; they are welcome to manage it as they see fit. Also: this is different from TestFlight.
tshaddox 4y ago
> "Sideloading is dangerous because users could install malware" and "We'll let any iPhone sideload your app if you jump through some hoops and pay us" are incompatible statements, but Apple makes both of them. I'm missing how these are incompatible statements. You might as well say "if Apple thought certain apps could be dangerous they wouldn't have an App Store or even allow their own first-party apps on iPhones." Of course the position of Apple is that they should be able to approve every app/vendor before it's allowed to be installed on iPhones. The fact that they do approve some apps and vendors isn't incompatible with their position.

mcculley 4y ago

The warning looks like this: https://support.apple.com/library/content/dam/edam/applecare/images/en_US/iOS/iphone6-ios9-enterprise-untrusted_enterprise_app.png https://support.apple.com/library/content/dam/edam/applecare... EDIT: Formerly I asked: What does the scary warning look like? Is there a screenshot of an example? I would like to show this to my employees and family and tell them never to trust such a cert.

dylan604 4y ago
At least it doesn't have "Accept Anyways" type of button. The only option is to cancel whatever it was being attempted.
- jtbayly 4y ago
  So how do you install it?
  - joshstrange 4y ago
    Here is the full flow: https://imgur.com/a/ofvfty8 https://imgur.com/a/ofvfty8
    - dylan604 4y ago
      Who does this kind of app install, and what do these kinds of apps promise that makes this sound like it is worth doing?
      - joshstrange 4y ago
        I believe I remember reading about Google or FB having an app for employees to order food from the cafeteria as well as apps for internal tools/build pipelines/etc. While some POS apps like Square are in the app store there are others that are distributed through enterprise apps. It allows companies to push updates faster when/if something goes wrong. I also know (at least in the past) NetJets used enterprise apps for their pilots, the apps had the flight manual among other things if I remember correctly. Often it's custom or white labeled software that benefits from enterprise distribution. EDIT: Also if an organization is large enough TestFlight might not be suitable to cover everything they need. For example you might want nightly developer builds, weekly/milestone internal test builds, stagings builds, and then TestFlight and release. You can accomplish this with multiple apps that are never released (My App - Dev, My App - QA) so you can use TestFlight for each and then only release the production "My App" but that has some sharp edges and requires everyone be added to the Apple development team.

Dagonfly 4y ago

> but the app store review process makes it harder to sneak one by. Imo the key question is: If you can find an exploit in the iOS sandbox, will the app store review really stop you? Compared to the expertise required to find such an exploit, it should be pretty trivial to obfuscate it or load the payload remotely after install.

duskwuff 4y ago
> Imo the key question is: If you can find an exploit in the iOS sandbox, will the app store review really stop you? The App Store review is two-pronged -- it includes some human QA testing, and it also includes some automated screening of your executable, which includes checking for any suspicious library imports or strings. (This sometimes trips up applications which happen to use method names which happen to match up with Apple's internal APIs.) While it isn't entirely impossible for a malicious application to slip past this examination, it's significantly harder than for an Enterprise application which doesn't go through this process at all.
- saagarjha 4y ago
  App Store Review’s automated scanning is quite trivial to get around, most iOS developers can either attest to doing so themselves or knowing someone who has done this.

aaomidi 4y ago

Well people are being trained to install this due to MDM.

easrng 4y ago

You can buy enterprise certs from other companies, that's how the stores like jailbreaks.fun (safe) or AppValley or AppCake (very questionable) get them.

tshaddox 4y ago

I couldn't agree with you more. I certainly see some very valid arguments for why Apple should allow sideloading on iPhones, but I am baffled by this extremely common argument that goes "here's an example of Apple not being restrictive enough to protect people, therefore Apple shouldn't be restrictive at all."

nickff 4y ago
You're observing 'motivated reasoning', where someone started with the result (Apple is wrong to disallow side-loading), and came up with a way to support it.

jrochkind1 4y ago

> And enterprise certs aren't so easy as "just give Apple $299", try and get one then get back to me. I believe you, but... so how does a "commercial spyware" company get one, and has it been cancelled by Apple after they see what they are up to? Or do their not-so-easy requirements... allow "commercial spyware" companies to fraudulently impersonate other apps with the cert?

LocalH 4y ago
I know there have been several independent "signing services" driven by these type of enterprise certs, and usually when Apple finds out that they've been used like this, they'll revoke them. The only real time I've personally ran into this is when I was away from my computer for an extended period of time and needed to reinstall the on-device jailbreak app (which would have been unc0ver).

usrn 4y ago

There's malware on the AppStore. The review process is completely incapable of catching it.