4 ms·
App Store has a number of manual and automated checks. One of which is checking for private API usage which would allow developers to cause all sorts of unchec
by threeseed 3y ago
App Store has a number of manual and automated checks.
One of which is checking for private API usage which would allow developers to cause all sorts of unchecked havoc.
And because of the way Objective-C apps work i.e. dynamic dispatch you can't statically check for it in the binary when the app is launched. Nor can you realistically check it at runtime since that code path is the hottest there is and needs to be highly optimal.
I suspect that there will be an App Store SDK that third party stores will need to use that incorporates these sort of checks.
- ianlevesque 3y ago> which would allow developers to cause all sorts of unchecked havoc. This is simply not true. The security boundary is not at that layer. Calling private methods doesn't escape the sandbox.
- judge2020 3y agoSure, but private methods are another vector - tracking and bypassing the IDFA and potentially acting as official Apple Apps to use/abuse things like Carrier/SIM info[0], updating the wallpaper for the user[1], accessing call history[2], etc. 0: https://github.com/nst/iOS-Runtime-Headers/blob/fbb634c78269b0169efdead80955ba64eaaa2f21/Frameworks/CoreTelephony.framework/CTMobileEquipmentInfo.h#L10 https://github.com/nst/iOS-Runtime-Headers/blob/fbb634c78269... 1: https://github.com/nst/iOS-Runtime-Headers/issues/32 https://github.com/nst/iOS-Runtime-Headers/issues/32 2: https://github.com/nst/iOS-Runtime-Headers/tree/fbb634c78269b0169efdead80955ba64eaaa2f21/PrivateFrameworks/CallHistory.framework https://github.com/nst/iOS-Runtime-Headers/tree/fbb634c78269...
- saagarjha 3y agoThese are all security issues that Apple fixes by moving them outside of the process.
- ChadNauseam 3y agoIf you can't statically check for it, how does the app store check for it? Do they just open up the app and poke around with the runtime-private-api-detector enabled?