7 ms·
Techniques used by developers to bypass App Store review
- ilrwbwrkhv 2y agoHow do these apps like collect cards reach the top of the app store to begin with? Is it because they are simply masquerading as piracy apps? And piracy apps are downloaded a lot?
- voiceblue 2y agoI think you've got your use of 'masquerading' here backwards. These *are* piracy apps, and presumably people share them since they want their friends to have free content too.
- ilrwbwrkhv 2y agoSorry yes. That's what I meant. So simply piracy app hidden behind something else is enough to go to the top of the app store.
- ec109685 2y agoFor those curious, here is Apple’s language on dynamic updates like what codepush allows: https://github.com/microsoft/react-native-code-push#store-guideline-compliance https://github.com/microsoft/react-native-code-push#store-gu... “Executable Code Except as set forth in the next paragraph, an Application may not download or install executable code. Interpreted code may be downloaded to an Application but only so long as such code: (a) does not change the primary purpose of the Application by providing features or functionality that are inconsistent with the intended and advertised purpose of the Application as submitted to the App Store, (b) does not create a store or storefront for other code or applications, and (c) does not bypass signing, sandbox, or other security features of the OS.”
- kevingadd 2y agoAt least in live service games, nearly 100% of them pull down new interpreted code on a regular basis on mobile, which means they're all basically circumventing app store review. It seems like it's just an agreement between game developers and Google/Apple that in exchange for bypassing review, the billions of dollars worth of lootbox money will keep flowing.
- robertlagrant 2y agoThat seems odd. No reason Apple couldn't review the updates to the games, with or without lootbox money.
- jonplackett 2y agoThe point with this kind of update is it doesn’t go through the App Store review process at all. The developer just sends the new content / feature straight into the app which was approved based on its original version.
- robertlagrant 2y agoYes, I know. My point has that in mind.
- ycombinatrix 2y agoThey can't review dynamic updates because they don't exist yet. They get downloaded to the app at runtime.
- ec109685 2y agoThat seems explicitly allowed by that paragraph, no?
- m-p-3 2y agoAnd yet they don't allow web browsers to use their own rendering engine or have their own extension system..
- j45 2y agoThis feels relatively open ended, for an app that will largely still be after the same result without going after it in a grossly different way. One feature set I notice is how many apps have you pay outside of Apple's walled system for a subscription because the actual work of the app is done in the cloud, and not entirely on device. Separating the app into a basic local app with extra work in the cloud seems to have merits, but with the increased horsepower on devices, it is more and more appealing to see what can be done locally. If an app has a high level and clear enough layout, the details that fill them out can fill in. I've been a fan of things like SDUI (Software defined UI) for a while, to allow more dynamic interface generation based on user preferences, usage, etc. The approach of creating software that is for a fixed business process is more and more becoming outdated. Replacing fixed mindset software with software where flexibility is required, whether during the different stages of pandemic lockdowns, or truly personalizing a user's experience.
- wannacboatmovie 2y agoNewsflash: Apple doesn't care. I've reported malicious apps. Provided detailed evidence, etc. Their security team told me to fuck off. So I went back to my daily life... At least I can say I tried. Security doesn't matter; it's the appearance of security that does. Apple is like the walled fortress with armed guards in freshly pressed uniforms that wave most people through the gate and never check their trunks.
- cedws 2y agoMore specifically some combination of an algorithm and outsourced first line support in India told you to fuck off. It is incredibly hard to get through to a human with the powers to actually solve problems in these tech companies. I've been through it many times. Often the algorithm's say is final and you can't get through to anybody able to override it. It's even worse when the decision is made by machine learning because it's a black box, and they can't even explain why the decision was made.
- kevin_thibedeau 2y agoBecause Apple is so hard up for cash they can't pay for quality customer support.
- cedws 2y agoCan't juice quarterly profits by splashing cash on better support.
- FireBeyond 2y agoThis is common for Apple, even beyond this. It's commonly accepted among tech savvy Apple users, and developers that Radar (bug tracking) was essentially a black hole. You could see what you sent to it, but you couldn't see any information on your report.
- neilv 2y agoBut how do developers trick App Store into approving legitimate apps?
- butz 2y agoIssue here, is that developers of legitimate apps have morals and decency.
- joshstrange 2y agoThis. The amount of hoops I’ve had to jump through trying to follow the rules perfectly is really annoying when I look at my competitors blatantly breaking the rules. I’ve asked support direct questions (via phone support) and they say “no you can’t do that” (confirming what I thought the rules said) but they are uninterested in hearing about others breaking the rules.
- Bluestrike2 2y agoSubmit illegitimates ones instead? At least, there are days when it seems like that’s how it apparently works.
- isodev 2y agoSometime we fail to do that too. Even legitimate apps have their quota of rejections (even for no good reason at all) before making it into the App Store. The review process is a dark and twisty place.
- neontomo 2y agodoes anyone here have any insight into what they look for? i've published a few apps and they don't seem to care at all about code quality or security, but do care about whether i declare my security method and whether i allow users to delete their accounts. what do they check for?
- ryandrake 2y agoThey publish their review guidelines: https://developer.apple.com/app-store/review/guidelines/ https://developer.apple.com/app-store/review/guidelines/
- bitpush 2y agoIsnt the whole point of $99 and rigorous checks, and not to mention, all the marketing and legal claims, to say that Apple's App Store review process is foolproof and necessary for their platform? Also, so funny how 9to5mac messages this. When Apple makes a misstep, it is developers "tricking" App Store, not Apple's incompetence. Lets call it what it is, Apple's review process is mostly security theater.
- shreddit 2y agoBut then what isn’t? You can’t check everything/everybody. Pyrotechnics are forbidden at football stadiums, there are security at the entrance but they get them inside anyway. Goods of stores with security still get stolen. Smuggling still exists. There is no 100%
- realusername 2y agoSecurity will always start with strong software guarantees, not "guidelines" enforced arbitrarily. See the web which is doing better on this subject.
- shreddit 2y agoIt is? The last time i checked i can easily watch a pirated movie while downloading malware on arbitrary websites…
- realusername 2y agoYeah and the top apps on the iPhone are basically half-legal casino games. At least on your example you have to search for it and disable all warnings.
- shreddit 2y agoWell any ad from a normal site can bring me to a shady site. The barrier to install an app is much bigger imho.
- seanalltogether 2y agoI just used a time based trick when I needed to push through behavior that apple didn't like. 20 days after submitting the app one of the buttons changed it's behavior to allow a "File Open" dialog to go directly to the users root directory.
- eddd-ddde 2y agoI love it, goes to show how useless the app verification process is. One could probably find a way of fingerprinting reviewer systems to directly hide the feature only for them.
- 1986 2y agoUber tried to do this, they geofenced Cupertino for a feature so it wouldn't appear during app review
- plumeria 2y agoDoes "tried" imply they weren't successful?
- eddd-ddde 2y agoThe linked post mentions they getting caught after a while.
- stephenhuey 2y agoSeems pretty unreliable. At least I know a recent Google Play Console reviewer was located at the Google office in Lisbon. I wouldn't be surprised if Apple used reviewers outside Cupertino.
- chedabob 2y agoYe we've had apps rejected because they hit our IP geoblock, and the logs would always indicate they were testing via an Irish mobile network. We specifically allow-listed Apple's /8 range, but they don't always use the corporate VPN.
- bluish29 2y agoThere are telegram channels/groups with thousands of people interested in the latest app that will survive the app store review and use it until apple takes action and cycle goes on. There are also a market for signing certificates and apple developer machines spots so more tech savvy audience could sign and install the IPAs directly.
- tempodox 2y agoSadly Apple doesn't need to be tricked to let spammy and scammy apps into the store. All that song and dance about protecting users is just marketing.
- TheCoelacanth 2y agoIt's never been about protecting users. It's about controlling users and protecting Apple's profits.
- add-sub-mul-div 2y agoEven if it was completely reliable at preventing malicious apps, I couldn't imagine being on a platform that required their permission to run a given piece of code. The fact that it's not reliable makes it even harder to understand why people accept it.
- Someone 2y ago100% unrelated: how sites trick users into ‘approving’ cookies. That site has the most evil consent UI I’ve seen. Not only does it require you to click zillions of checkboxes to withdraw consent, while allowing you to give it with a single click, it also hides most of them behind a “more” button. It’s amazing how many companies claim to have legitimate interest in tracking things…
- Nextgrid 2y agoYou can blame lax/non-existent GDPR enforcement for this. This is against the GDPR (and no better than just not having a consent flow in the first place) but is allowed to continue since nobody cares about enforcing it. Actually, the only reason the consent flow is there is because advertising providers require it (but only require the presence of one, ignoring the actual GDPR compliance of it).
- BartjeD 2y agoI doubt that advertisers require a bogus consent flow implementation. More likely their legal checkbox is that GDPR rights are properly protected, such as via a consent flow, if needed. That normally requires an assessment of the rights impacted, the data collected, and the required consents, and an implementation of the flow itself to cover that. This assessment has to be done by the app or website displaying the advertising. And also by the advertiser. As you can probably guess, writing such an assessment is knowledge work and costs time. People quickly noticed that if they just skip this and put in a consent flow, bogus or not, no one will care... So money saved? Probably the market was right, most companies will save money that way. Which is both unfortunate but also logical. However, it's also a huge legal liability if your app or website operates in certain sensitive domains. Such as healthcare and politics, and possibly social media. Because it may turn out the product didn't have the right to collect any data. And that sensitive data was collected (could be inferred). And that the advertiser should have known this, because of a bogus implementation consent flow. Then the final question is: What's the damage? Why is this is a 'huge' liability? Answer: At this stage you're looking at class actions in the US, or 'snipperschade' claims (mass 'little-damage' renumeration) in the EU. Art. 82 of the GDPR provides for the possibility of compensation, including for immaterial damage. Successfully claiming damage under that article lacks a large corpus of case-law. It is 'in development'. Largely because the requirements of evidence are difficult to meet in most cases. Especially those not involving sensitive categories of data. In the event of a mass art. 82 claim for sensitive data, one may expect both the advertiser as well as the product displaying advertising to be targeted. And lawyers would be incentivized to pursue this via a mass 'class' action. Which magnifies the claim to a portion of the affected EU population (500 million) and an amount of monetary compensation. So let's say 2,500,000 * 30 euro's = 75,000,000. So a fairly small portion of people (0,5%) and a small amount of remuneration. Amounts to 75 million in damages. Lawyers take home a percentage of that. In essence this is a lawsuit waiting to happen. But probably not to you, and not to this app.
- cobbal 2y agoCalling a piracy app "malicious" seems like a huge stretch. Am I missing something, or was this written by the copyright holders?
- Nextgrid 2y agoOn the other hand, if piracy apps can do this (and I'd argue Apple cares more about piracy than actual malware), malware definitely can. But then again the top-grossing apps are already scams and have been around for as long as I can remember so this is not new.
- diebeforei485 2y agoSidenote: the vast majority of scam apps seem to take people's money using recurring weekly subscriptions. There are use cases for non-recurring week passes (eg. VPN app for a week during travel) but recurring weekly payments should require manual approval. Not all apps should be allowed to charge weekly recurring payments.
- waiwai933 2y agoEven if Apple were to defeat the geofencing trick, it's trivial to hide behavior: 1. Make an API call to your server with the build number of the app. 2. Have that API response control whether the "secret" features are available. 3. Only enable each build's secret features once it's passed review. 4. Profit? No dynamic/interpreted code required. And there are sufficient variations on this that I would guess it's reducible to the halting problem and thus undecidable.
- can16358p 2y agoYup. At the end of the day these logic-bomb-esque mechanisms are unpreventable and just a cat-and-mouse problem. There should be a way to battle this outside technical measures, like a crowdsourced group of real distributed humans testing apps for anything malicious.
- paulryanrogers 2y agoThis cannot as easily catch targeted attacks, which only send the malicious payload to certain people or niche groups.
- can16358p 2y agoDefinitely can't. Though that's another story, targeted attacks will always find a way to slip through. This method can protect the general public a bit more compared to the current "screening".
- ChrisMarshallNY 2y ago> a crowdsourced group of real distributed humans testing apps for anything malicious I guarantee they would get sued/attacked into oblivion, within a year or two. Look at what happens to Krebs. He gets SWATted, all the time. They would need some good backing, and have to be subject to fairly stringent controls, themselves.
- saagarjha 2y ago
- ycombinatornews 2y agoThere are many more ways to do this. Most of iOS developers who ever published apps know that. Hiding a functionality from Apple is a ticket to account and company ban and is not worth the hassle. Unless it was the intention of the whole enterprise.
- j45 2y agoIt would seem plausible though that apps built with feature flags do not trigger these kinds of lines. Being able to roll out, or roll back features (even approved ones) for testing, bug fixing, etc, seems pretty essential, especially for larger apps. It would be hard to wait for (up to?) weeks waiting for an app update to be approved.
- nox101 2y agoTons of apps are just a webview of a remote webpage. They update every time the server updates the page. No review required.
- heavyset_go 2y agoThe US desperately needs some DMA-like legislation, one company shouldn't be able to hold 60%+ of US users hostage when it comes to installing the apps they want to use. Similarly, two companies, Apple and Google, shouldn't be able to keep 15% to 30% of all revenue generated in the entire mobile app market.
- kelnos 2y agoI agree with you, but I don't see how this is relevant to the article.
- 23B1 2y agobecause the incentives OP describes are why you have this opaque, misaligned, user/developer-hostile ecosystem.
- rand_r 2y agoI’m not a fan of the control, but this is the free market at work. Nothing stops you or any other company from creating a competing phone with its own app ecosystem. It’s really not for the government to dictate to companies how their products can work. It’s up to consumers to choose the products they want to use.
- j45 2y agoI'm not sure if it's a free market when it's a private control. Life before app stores was a free market. And there was choice between app stores, and not. Not so much anymore. Convenience of an app store did bring an audience.
- thih9 2y ago> They’re built on React Native, a cross-platform framework based on JavaScript, and use Microsoft’s CodePush SDK which allows developers to update parts of the app without having to send a new build to the App Store I don’t see a reason to name Microsoft’s solution specifically. Firstly, there are other alternatives; also, Microsoft is shutting down parts of their offering; finally, JS apps are comparatively easy to update - even without a tool like this too.
- OsrsNeedsf2P 2y agoI did a short stint for a startup in Korea whose top investor wanted us to get around Apple and Google's 30% cut. After explaining the ToS and how the exemptions didn't apply to us, she set up a meeting with developers from another company she invested in. Those devs, with great smiles on their faces, proceeded to show a remote config that toggled which payment flow a user went through, depending on whether the app version was currently pending review
- mixmastamyk 2y agoSounds like the Volkswagen trick.
- sschueller 2y agoYes, but justified IMO unlike what VW and others did. These aren't government regulations, these are monopolistic tactics by a large monopoly.
- Zak 2y agoAnd for those who don't view government regulations as sacred, the regulation in question was designed to limit how much poison everyone has to breathe, while Apple and Google payment rules are designed to make more profit for those companies.
- nottorp 2y ago"Pirate streaming apps" ? I thought it was about how they get Apple to allow those $50/month subscriptions for the flashlight apps...
- fx18011 2y agoThere is a popular sports streaming app developed by burmese developer. The app looks like a normal sports news app with an instruction to tap the logo and type the number 3 three times in Burmese in the popup textbox. Upon entering the correct numbers, list of live streaming football matches appears.
- MichaelTheGeek 2y agoWhat has happened to Phil ?
- deathanatos 2y ago> In 2021, documents revealed that the App Store Review team has more than 500 human experts to review more than 100,000 apps every week. Ignoring the weasel wording in the sentence, and assuming the reviewers dedicate 100% of their time to reviewing and a standard work week, that's ≈12 minutes per app.
- whatisthiseven 2y agoAnd the gross revenue in 2021 for the Apple app store that same year was $85B. Alas, poor Apple just can't afford more reviewers to ensure every app has a meaningful review process and well paid workers who have a decent work environment. I assume they have a rushed quota of apps they must review per week. Why does Apple deserve the 30% cut, again?
- cflewis 2y agoHonestly more than I would have expected.
- roblh 2y agoThat’s honestly way higher than I would have expected.
- Tade0 2y agoSome apps apparently only go through a human after they gain enough traction, as evidenced by the Skacz Kurwa incident: https://youtu.be/Cw7wke_FtuI?si=3b6f3Ohd4wb_0xVS https://youtu.be/Cw7wke_FtuI?si=3b6f3Ohd4wb_0xVS Despite (and due to) its very much non-family-friendly title it managed to gain considerable attention before being taken down.
- Andrew_nenakhov 2y agoWe're looking at the wrong problem. The real problem is that developers have to pass (and bypass) reviews at all. I would not mind Apple doing whatever the reviews they want with their own private AppStore if I, the user, could install whatever app I need on the device that I bought by downloading it directly from developer's website. Apple maliciously tries to stand between developers and users, with the intent of extortion. Big Brother 2024.
- jonlucas3628 2y ago[dead]