6 ms·

As far as malware goes, this isn't really that bad. (EDIT: it doesn't e.g. steal your credit card info [unless you keep that info in your contacts list]) It's

by younata 14y ago

As far as malware goes, this isn't really that bad. (EDIT: it doesn't e.g. steal your credit card info [unless you keep that info in your contacts list]) It's simply an app that uploads your address book to a remote server. Up until recently, it was considered industry standard to do that. The only thing this app does different is that the server then sends SMS messages to the numbers it uploads from your address book. All this really is showing is that Apple should've made iOS from the beginning ask the user for permission before allowing an app to access the address book. After iOS 6, this app won't do anything.

ghshephard 14y ago
The problem is - this is a contact list manager - so you would expect to give permission to this app to access your contact list. Ideally apple has contact information for this developer, and, presuming the Developer violated some license with regards to what they can do with user data, Apple can now take legal steps against this developer.
- eps 14y ago
  Do you, realistically speking, see Apple doing that? Me neither. They should really just sandbox the apps and put a proper permission granting system in place.
  - ghshephard 14y ago
    But this is a contact list management application. It requires access to the address book. Any sandbox that would have been created would have allowed the application access to the contacts, even with the most stringent permissions.
  - lotu 14y ago
    Why not Apple has plenty of lawyers and wants to disuade other people from trying the same thing?
techinsidr 14y ago
I agree -- Sneaky, but probably not as malicious as most headlines are making it. http://www.securityweek.com/sneaky-ios-malware-surfaces-app-store-says-kaspersky http://www.securityweek.com/sneaky-ios-malware-surfaces-app-...
pacaro 14y ago
I think you're downplaying this. The illegitimate use of the address book is being masked by a legitimate use - even if permission is asked for it will likely be granted. What is essentially impossible to control except through manual app verification processes (and very hard even then) is what is done with the data once the app has access to them. As a total aside, if you are an AT&T customer you can just forward SMS spam to 7726 (SPAM) and they take care of it - I'm not affiliated with AT&T (just a customer) and I wish they would publicize this stuff more.
- ceejayoz 14y ago
  Not just AT&T, hundreds of GSM operators agreed to support 7726. How they react to reports probably varies, though. Verizon apparently supports, as well.
- unfasten 14y ago
  Thanks for the information about reporting spam text messages, I had never heard about it. I just received some spam text the other day and ended up reporting it through the FCC, but reporting straight to your mobile operator on the phone is much nicer. ceejayoz is right about Verizon also supporting this feature (I just reported the spam message I had from the other day). Via https://community.verizonwireless.com/message/696743#696743 https://community.verizonwireless.com/message/696743#696743 : From MikeS1_VZW We have heard our customers on this, and we have launched a new program to help with SPAM. Take one (or several) of the SPAM messages and forward it to 7726 (which spells SPAM). This is a new process. Once you forward the message to 7726, you will get a reply text message asking the identity of the SPAM sender (the "From" address in the SPAM message you received). Once received, you will get a "Thank-you" message from the 7726 number. We will investigate on the back end. The messages you send to and receive from the 7726 number are free of charge. This is a brand new program we are testing, and it just started on 09/1/11. Please make this common practice when receiving SPAM messages. This is not to be confused with alerts though. If you get alerts (something you signed up for), you should reply STOP to the message received before going the whole 7726 route.
  - 14y ago
monkeyfacebag 14y ago
I feel like this is missing the forest for the trees. What is the value of a curated app ecosystem like Apple's to the consumer if they cannot prevent malware from winding up on consumers' devices?
- mkaltenecker 14y ago
  That’s a false dichotomy. Preventing absolutely every piece of malware would be great, but merely preventing very nearly every piece of malware is also nice. You only have to compare Google’s and Apple’s stores to see that Apple’s approach is more effective (not much), though clearly not perfect. (Apple had the ability to remotely pull malware right from the beginning, clearly showing that they never believed the review process to be perfect in preventing malware.) Whether that trade-off is worth it is a completely different question (I think it is not – Apple should allow users to install whatever they want, they can even make enabling that needlessly complicated, but they should allow it.) but if you are immediately jumping to the conclusion that Apple’s curated approach is devoid of value because one piece of malware made it through your analysis of the situation is lacking and populist.
  - monkeyfacebag 14y ago
    This is a good rebuttal, but it remains to be seen whether Apple can actually prevent "nearly every piece of malware" from getting through. To be quite honest, I'm not even the slightest bit familiar with their review and approval process, but I have difficulty believing it can continue to scale without introducing security holes.
    - taligent 14y ago
      How long has the App Store been around what nearly 4 years ago ? It seems to be 'scaling' just fine.
- czr80 14y ago
  Clearly the only two options are perfect curation or none.
ajross 14y ago
Honestly, all malware "isn't really that bad" by the metrics you're using. Maybe it sends spam. Maybe it hogs your CPU. A few will crash your machine or break it in some obvious way. This one happened to steal your personal data (and attempt to steal that of your contacts'). You're right though, that it's basically exposing a hole in the OS security metaphor. Two really: the address book was unprotected and the application review process didn't work.
- younata 14y ago
  > Honestly, all malware "isn't really that bad" by the metrics you're using. Maybe it sends spam. Maybe it hogs your CPU. A few will crash your machine or break it in some obvious way. This one happened to steal your personal data (and attempt to steal that of your contacts'). I was thinking more of "this will not steal my credit card" (unless you keep that info in your address book) type of malware. But, yes. I get your point.
- josephcooney 14y ago
  Isn't this a trend in biology? Where less virulent strains of viruses out-perform more severe ones because they don't kill their hosts? Ebola is its own worst enemy because it kills its hosts, and kills them relatively quickly. I seem to recall reading that influenza or typhoid had become less dangerous in the last 100 years or so and they were attributing it to this, but I'm coming up blank on the google searches.
eragnew 14y ago
> All this really is showing is that Apple should've made iOS from the beginning ask the user for permission before allowing an app to access the address book. After iOS 6, this app won't do anything. Agreed. Re: the rest, well, it depends on who controls the remote server. The action itself might not be so worrisome, but what the action enables could be, IMO.

by younata 14y ago

ghshephard 14y ago

The problem is - this is a contact list manager - so you would expect to give permission to this app to access your contact list. Ideally apple has contact information for this developer, and, presuming the Developer violated some license with regards to what they can do with user data, Apple can now take legal steps against this developer.

eps 14y ago
Do you, realistically speking, see Apple doing that? Me neither. They should really just sandbox the apps and put a proper permission granting system in place.
- ghshephard 14y ago
  But this is a contact list management application. It requires access to the address book. Any sandbox that would have been created would have allowed the application access to the contacts, even with the most stringent permissions.
- lotu 14y ago
  Why not Apple has plenty of lawyers and wants to disuade other people from trying the same thing?

techinsidr 14y ago

I agree -- Sneaky, but probably not as malicious as most headlines are making it. http://www.securityweek.com/sneaky-ios-malware-surfaces-app-store-says-kaspersky http://www.securityweek.com/sneaky-ios-malware-surfaces-app-...

pacaro 14y ago

I think you're downplaying this. The illegitimate use of the address book is being masked by a legitimate use - even if permission is asked for it will likely be granted. What is essentially impossible to control except through manual app verification processes (and very hard even then) is what is done with the data once the app has access to them. As a total aside, if you are an AT&T customer you can just forward SMS spam to 7726 (SPAM) and they take care of it - I'm not affiliated with AT&T (just a customer) and I wish they would publicize this stuff more.

ceejayoz 14y ago
Not just AT&T, hundreds of GSM operators agreed to support 7726. How they react to reports probably varies, though. Verizon apparently supports, as well.
unfasten 14y ago
Thanks for the information about reporting spam text messages, I had never heard about it. I just received some spam text the other day and ended up reporting it through the FCC, but reporting straight to your mobile operator on the phone is much nicer. ceejayoz is right about Verizon also supporting this feature (I just reported the spam message I had from the other day). Via https://community.verizonwireless.com/message/696743#696743 https://community.verizonwireless.com/message/696743#696743 : From MikeS1_VZW We have heard our customers on this, and we have launched a new program to help with SPAM. Take one (or several) of the SPAM messages and forward it to 7726 (which spells SPAM). This is a new process. Once you forward the message to 7726, you will get a reply text message asking the identity of the SPAM sender (the "From" address in the SPAM message you received). Once received, you will get a "Thank-you" message from the 7726 number. We will investigate on the back end. The messages you send to and receive from the 7726 number are free of charge. This is a brand new program we are testing, and it just started on 09/1/11. Please make this common practice when receiving SPAM messages. This is not to be confused with alerts though. If you get alerts (something you signed up for), you should reply STOP to the message received before going the whole 7726 route.
- 14y ago

monkeyfacebag 14y ago

I feel like this is missing the forest for the trees. What is the value of a curated app ecosystem like Apple's to the consumer if they cannot prevent malware from winding up on consumers' devices?

mkaltenecker 14y ago
That’s a false dichotomy. Preventing absolutely every piece of malware would be great, but merely preventing very nearly every piece of malware is also nice. You only have to compare Google’s and Apple’s stores to see that Apple’s approach is more effective (not much), though clearly not perfect. (Apple had the ability to remotely pull malware right from the beginning, clearly showing that they never believed the review process to be perfect in preventing malware.) Whether that trade-off is worth it is a completely different question (I think it is not – Apple should allow users to install whatever they want, they can even make enabling that needlessly complicated, but they should allow it.) but if you are immediately jumping to the conclusion that Apple’s curated approach is devoid of value because one piece of malware made it through your analysis of the situation is lacking and populist.
- monkeyfacebag 14y ago
  This is a good rebuttal, but it remains to be seen whether Apple can actually prevent "nearly every piece of malware" from getting through. To be quite honest, I'm not even the slightest bit familiar with their review and approval process, but I have difficulty believing it can continue to scale without introducing security holes.
  - taligent 14y ago
    How long has the App Store been around what nearly 4 years ago ? It seems to be 'scaling' just fine.
czr80 14y ago
Clearly the only two options are perfect curation or none.

ajross 14y ago

Honestly, all malware "isn't really that bad" by the metrics you're using. Maybe it sends spam. Maybe it hogs your CPU. A few will crash your machine or break it in some obvious way. This one happened to steal your personal data (and attempt to steal that of your contacts'). You're right though, that it's basically exposing a hole in the OS security metaphor. Two really: the address book was unprotected and the application review process didn't work.

younata 14y ago
> Honestly, all malware "isn't really that bad" by the metrics you're using. Maybe it sends spam. Maybe it hogs your CPU. A few will crash your machine or break it in some obvious way. This one happened to steal your personal data (and attempt to steal that of your contacts'). I was thinking more of "this will not steal my credit card" (unless you keep that info in your address book) type of malware. But, yes. I get your point.
josephcooney 14y ago
Isn't this a trend in biology? Where less virulent strains of viruses out-perform more severe ones because they don't kill their hosts? Ebola is its own worst enemy because it kills its hosts, and kills them relatively quickly. I seem to recall reading that influenza or typhoid had become less dangerous in the last 100 years or so and they were attributing it to this, but I'm coming up blank on the google searches.

eragnew 14y ago

> All this really is showing is that Apple should've made iOS from the beginning ask the user for permission before allowing an app to access the address book. After iOS 6, this app won't do anything. Agreed. Re: the rest, well, it depends on who controls the remote server. The action itself might not be so worrisome, but what the action enables could be, IMO.