6 ms·

> Yes, it's been Apple's modus operandi with the App Store from the start: trick consumers into thinking the App Store being a monopoly is the only thing that c

> Yes, it's been Apple's modus operandi with the App Store from the start: trick consumers into thinking the App Store being a monopoly is the only thing that can protect them against malware, illicit and questionable app content, pirated software, scams, and fraud. Which is ironic, considering that the App Store is likely one of the largest malware distribution vectors on the planet. Looking at one virus alone, the App Store distributed half of a billion copies of it to iPhones and iPads[1]. Similarly, there are multimillion dollar scams on the App Store, as well[2]. [1] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is-exposing-details-about-the-biggest-iphone-hack-of-all-time https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is... [2] https://www.theverge.com/2021/2/8/22272849/apple-app-store-scams-ios-fraud-reviews-ratings-flicktype https://www.theverge.com/2021/2/8/22272849/apple-app-store-s...

jerbear4328 3y ago
That one virus on the App Store was one of, if not the biggest known instance of a virus on the App Store, and your article gives a number four times smaller than half a billion. From your [1]: > But now, thanks to emails published as part of Apple's trial against Epic Games, we finally know how many iPhone users were impacted: 128 million in total, of which 18 million were in the US. > "In total, 128M customers have downloaded the 2500+ apps that were affected LTD. Those customers drove 203M downloads of the 2500+ affected apps LTD," Dale Bagwell, who was Apple's manager of iTunes customer experience at the time, wrote in one of the emails. > Apple also disclosed the apps that included the malicious code, some incredibly popular such as WeChat and the Chinese version of Angry Birds 2. Still a huge deal, particularly in China, but considering all the virus really did was collect some device info (less information than most ad networks) (and maybe it was able to open URLs and popups on command)[1] and it was the biggest virus on the App Store ever (that I can find), maybe not as awful as you suggest. The scams on the App Store, yeah that's pretty bad. Though, can you point me at a marketplace as big as the App Store without loads of scams? [1]: https://www.lookout.com/blog/xcodeghost#what-does-it-do https://www.lookout.com/blog/xcodeghost#what-does-it-do
- pjerem 3y ago
  > all the virus really did was collect some device info (less information than most ad networks) Nah, that would mean that what really protects iOS users from malwares is just a good sandboxing mechanism and not the "human" control of the App Store. That would also mean that bypassing the App Store shouldn’t be a real security issue.
  - ffgjgf1 3y ago
    It’s pretty clear that it’s both. Claiming otherwise is a bit disingenuous. An app store with no human or automatic validation and not $100 would have a magnitude or two more malware.
    - ric2b 3y ago
      Can you back that up with an example, perhaps the Android Play Store? Is there significantly more malware on recent (last ~5 years) versions of Android than similarly recent versions of iOS?
      - paulmd 3y ago
        Google play store also uses human review. The question is whether there’s more malware on stores like f-droid, and the answer is yes, there is of course significantly more malware. This even pollutes the official Play Store to some extent because of course google can’t put the foot down too hard when Facebook et al can simply “start their own app stores” to bypass review if they really want to. Malware rates are much higher on android in general. https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker...
- egeozcan 3y ago
  > Though, can you point me at a marketplace as big as the App Store without loads of scams? Not the person you're replying to but isn't that the point?
- 3y ago
bushbaba 3y ago
How’s that compare to android though? For the most part apple’s walled garden IS safer and more privacy preserving than android.
- dtech 3y ago
  What kind of take is this? The main channel for apps is extremely similar to iOS's App store. I highly doubt if there is a difference, it's due to non-Google App stores or sideloading.
  - sroussey 3y ago
    Isn’t that the point?
  - GeekyBear 3y ago
    > I highly doubt if there is a difference, it's due to non-Google App stores or sideloading. Tech journalists have literally warned Android users that they need to be wary of apps from inside Google's walled garden. > With malicious apps infiltrating Play on a regular, often weekly, basis, there’s currently little indication the malicious Android app scourge will be abated. That means it’s up to individual end users to steer clear of apps like Joker. The best advice is to be extremely conservative in the apps that get installed in the first place. A good guiding principle is to choose apps that serve a true purpose and, when possible, choose developers who are known entities. Installed apps that haven’t been used in the past month should be removed unless there’s a good reason to keep them around. https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker...
    - willsmith72 3y ago
      Once you've submitted apps for review enough times, you get to know how arbitrary the review process is. Many, many people game the system in terms of in-app payments, e.g. showing a link to subscribe on their website but hiding the link for the review. If they can't catch that, why do you they can catch anything?
zer0zzz 3y ago
Citing xcodeghost as a big smoking gun of Apple malfeasants is absurd. Apple handled that whole situation really well considering it came from a bunch of downloader websites where the attacker had modified clang and Xcode.
nodamage 3y ago
> Which is ironic, considering that the App Store is likely one of the largest malware distribution vectors on the planet. Sorry but the actual statistics from mobile security companies that track this stuff show otherwise. From Nokia's Threat Intelligence Report 2020 (https://pages.nokia.com/T005JU-Threat-Intelligence-Report-2020.html https://pages.nokia.com/T005JU-Threat-Intelligence-Report-20...): Among smartphones, Android devices are the most commonly targeted by malware. Android devices were responsible for 26.64% of all infections, Windows/PCs for 38.92%, IoT devices for 32.72% and only 1.72% for iPhones. Android malware infections are an order of magnitude higher compared to iPhones. (I tried to look for data from more recent years but iPhones don't show up in the reports after 2020.)
52-6F-62 3y ago
Meanwhile I can’t even get them to approve a simple midi remote app… They need to “investigate”

jerbear4328 3y ago

That one virus on the App Store was one of, if not the biggest known instance of a virus on the App Store, and your article gives a number four times smaller than half a billion. From your [1]: > But now, thanks to emails published as part of Apple's trial against Epic Games, we finally know how many iPhone users were impacted: 128 million in total, of which 18 million were in the US. > "In total, 128M customers have downloaded the 2500+ apps that were affected LTD. Those customers drove 203M downloads of the 2500+ affected apps LTD," Dale Bagwell, who was Apple's manager of iTunes customer experience at the time, wrote in one of the emails. > Apple also disclosed the apps that included the malicious code, some incredibly popular such as WeChat and the Chinese version of Angry Birds 2. Still a huge deal, particularly in China, but considering all the virus really did was collect some device info (less information than most ad networks) (and maybe it was able to open URLs and popups on command)[1] and it was the biggest virus on the App Store ever (that I can find), maybe not as awful as you suggest. The scams on the App Store, yeah that's pretty bad. Though, can you point me at a marketplace as big as the App Store without loads of scams? [1]: https://www.lookout.com/blog/xcodeghost#what-does-it-do https://www.lookout.com/blog/xcodeghost#what-does-it-do

pjerem 3y ago
> all the virus really did was collect some device info (less information than most ad networks) Nah, that would mean that what really protects iOS users from malwares is just a good sandboxing mechanism and not the "human" control of the App Store. That would also mean that bypassing the App Store shouldn’t be a real security issue.
- ffgjgf1 3y ago
  It’s pretty clear that it’s both. Claiming otherwise is a bit disingenuous. An app store with no human or automatic validation and not $100 would have a magnitude or two more malware.
  - ric2b 3y ago
    Can you back that up with an example, perhaps the Android Play Store? Is there significantly more malware on recent (last ~5 years) versions of Android than similarly recent versions of iOS?
    - paulmd 3y ago
      Google play store also uses human review. The question is whether there’s more malware on stores like f-droid, and the answer is yes, there is of course significantly more malware. This even pollutes the official Play Store to some extent because of course google can’t put the foot down too hard when Facebook et al can simply “start their own app stores” to bypass review if they really want to. Malware rates are much higher on android in general. https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker...
egeozcan 3y ago
> Though, can you point me at a marketplace as big as the App Store without loads of scams? Not the person you're replying to but isn't that the point?
3y ago

bushbaba 3y ago

How’s that compare to android though? For the most part apple’s walled garden IS safer and more privacy preserving than android.

dtech 3y ago
What kind of take is this? The main channel for apps is extremely similar to iOS's App store. I highly doubt if there is a difference, it's due to non-Google App stores or sideloading.
- sroussey 3y ago
  Isn’t that the point?
- GeekyBear 3y ago
  > I highly doubt if there is a difference, it's due to non-Google App stores or sideloading. Tech journalists have literally warned Android users that they need to be wary of apps from inside Google's walled garden. > With malicious apps infiltrating Play on a regular, often weekly, basis, there’s currently little indication the malicious Android app scourge will be abated. That means it’s up to individual end users to steer clear of apps like Joker. The best advice is to be extremely conservative in the apps that get installed in the first place. A good guiding principle is to choose apps that serve a true purpose and, when possible, choose developers who are known entities. Installed apps that haven’t been used in the past month should be removed unless there’s a good reason to keep them around. https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker...
  - willsmith72 3y ago
    Once you've submitted apps for review enough times, you get to know how arbitrary the review process is. Many, many people game the system in terms of in-app payments, e.g. showing a link to subscribe on their website but hiding the link for the review. If they can't catch that, why do you they can catch anything?

zer0zzz 3y ago

Citing xcodeghost as a big smoking gun of Apple malfeasants is absurd. Apple handled that whole situation really well considering it came from a bunch of downloader websites where the attacker had modified clang and Xcode.

nodamage 3y ago

> Which is ironic, considering that the App Store is likely one of the largest malware distribution vectors on the planet. Sorry but the actual statistics from mobile security companies that track this stuff show otherwise. From Nokia's Threat Intelligence Report 2020 (https://pages.nokia.com/T005JU-Threat-Intelligence-Report-2020.html https://pages.nokia.com/T005JU-Threat-Intelligence-Report-20...): Among smartphones, Android devices are the most commonly targeted by malware. Android devices were responsible for 26.64% of all infections, Windows/PCs for 38.92%, IoT devices for 32.72% and only 1.72% for iPhones. Android malware infections are an order of magnitude higher compared to iPhones. (I tried to look for data from more recent years but iPhones don't show up in the reports after 2020.)

52-6F-62 3y ago

Meanwhile I can’t even get them to approve a simple midi remote app… They need to “investigate”