Two scam apps stink up iTunes store, pulled thanks to Reg reader Apple allowed two scam apps to appear in its App Store - and the dodgy software remained on sale for five days until a Reg reader raised the alarm. The two paid-for programs, built by developer JB Solutions, do not work as advertised in the online shop, sparking a surge in negative feedback comments left by ripped-off fanbois …
Curation is BS because unless Apple invent a tool which deconstructs an app and tells you exactly what functionality it offers, there will be malware, or apps which don't do what they claim, or do more than they claim.
It would be trivial to throw an up on the store which is completely innocuous, e.g. some quote of the day app which downloads some interesting quote every day, and then 100 days down the road instead of downloading a quote of the day it downloads an instruction which puts it in nasty mode and robs your address book, or sends you off to a website where some malicious payload is lurking.
Chances are Apple wouldn't find it either until it was too late.
Because it's impossible.
Calling an API doesn't show malicious intent. My hypothetical quote of the day app has a legitimate reason to hit some url to fetch the quote. Maybe it also fetches a graphic too and a bit of meta data. All very innocent. I could easily craft some code which throws an exception only with the malicious content, e.g. maybe a title which is 256 characters causes an exception to throw and somewhere up the chain it redirects the user to a "report error" page url. When Apple test it, even if they sport the report error url, it all looks legit. Perhaps my app also has some legitimate reason to look in my contacts, e.g. offering me the feature to email a quote of the day to a friend, but when operating maliciously it actually steals my address book by accidentally not null terminating a character array which just happens later to be used in the report error screen. It's so easy.
Short of someone doing a line by line security audit, feeding the app with every possible input Apple will NEVER find this.
This is why curation is false security. I'm sure Apple do have scanners which look for signatures of known trojans, command and control urls, and might even give the app a cursory once over in some virtual machines with different date and time parameters and so on. But it's not hard for someone to circumvent this. Look how many phony apps already get through. Look how many apps turn out to be stealing data already. Apple didn't catch these. There's no reason to think they'd catch my hypothetical app either.
This post has been deleted by its author
How the hell did the NFC app get through the App checking people? the phone doesnt even support it, so surely something with NFC in the title would be heavily reviewed.
I thought apple were crunching down on the amount of shit soundboards, barely functional and fake apps from people tryna get into the appstore
That it almost certainly wasn't labelled as an NFC app when it was reviewed, sounds like it was a radio app, ditto for the other one, which seems to be an alarm clock.
What I'm guessing happened here is that a dev submitted the dull apps, got them approved then later changed the descriptions and screenshots in the store to represent them as something else.
I don't understand why though as Apple are clearly going to get wind of this sort of thing and boot the dev from the store long before the dev receives a payment from Apple.
Jubtatisc1 hit the nail on the head.
The problem is that while apps are initially fully reviewed, changes to descriptions aren't - this is to allow developers to quickly communicate problems or quickly promotions without waiting a week for the new description to be approved.
Maybe what's needed is a method to allow small description updates, but not allowing major rewriting of what the app does..
"The second dodgy program, NFC for iPhone 5, cost $0.99 (£0.69) and promised to enable Near-Field Communications support - useful for making wireless payments - in the smartmobe."
So all those fannybois who dismissed NFC in competitors phones as a fad, s*ck it! Your brethern seem to think otherwise!
As an iOS dev I can only say that Apple's store checking procedures are a bit.. mixed? I've seen numerous examples of blatantly dodgy apps going through and scamming lots of customers. They've usually got professionally designed screenshots (usually with sexy women), poor descriptions (probably machine translated from chinese), and they're generally clones of popular apps (like Camera+ Pro instead of Camera+). The actual apps are generally nothing like the description, and crap.
I've also had my own apps rejected for the most trivial of reasons - you wouldn't believe how strict they can be when they want to be. One app was rejected for having a small icon for an apple app visible in part of a screenshot, which was considered abuse of apple's copyrighted material (yes, an icon that's included in iOS, in a screenshot for an iOS-only app for the iOS-only app store - the horror!) Clearly the reviewer was going through with a fine-toothed comb that day!
"It's not clear whether the phony apps pose a security risk, but it is clear users ended up paying out for software completely unlike what was expected."
inb4
"It's not clear whether the phones pose a security risk, but it is clear users ended up paying out for hardware completely unlike what was expected."
This post has been deleted by its author
>You can easily contact Apple and complain about dodgy app that don't do what they say, I've done it for a few a few apps and always been refunded the very same day, no questions asked.<
You're lying (no offence), when I got an app that didn't do what it said, a process killer, it took about a week of emails back and forth to Apple before they refunded me. Also, in the terms and conditions, you have no right to ask for a refund on apps you don't like, and very few people do get refunds, though many people complain, which you can check out in the apple forums. Some complaints even mention not getting responses back from Apple.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
