My educated guess: "Time Bomb" style code - ie malicious code that activates after a certain date. Objective-C supports dynamic method invocation, so it would

My educated guess: "Time Bomb" style code - ie malicious code that activates after a certain date. Objective-C supports dynamic method invocation, so it would be trivial to obfuscate calls to private APIs. Slip something like that into a decent app and you're set. Likely Apple's binary analysis wouldn't be good enough to catch all of this so with a little bit of guess and check it could be accomplished. Something similar to this has been proven (attack vector was safari) and the security researcher ended up getting his developer account banned [1]. Add in the incentive of harvesting credit card information (future) and contacts (current), mix with a little bit of social sharing via twitter (@my_friend I found an awesome app that makes Justin Bieber fart sounds), and you've got yourself a semi-decent infection cycle. [1]: http://www.dailytech.com/Developer+Demonstrates+Serious+Security+Breach+in+iOS+Apple+Bans+His+Account/article23216.htm http://www.dailytech.com/Developer+Demonstrates+Serious+Secu...