How malware gets into the App Store and why Apple can't stop that | Hacker News Reader

How malware gets into the App Store and why Apple can't stop that

habr.com

158 pointssharjeelsayed42 comments

Until we have some outrageously horrible events which will affect directly general population, all this facts will be comfortably avoided and "mitigated".

This is systemic problem derived not only from bad management and absence of responsibility.

This is "business as usual" with any big corporation. There is no problem until perception of the problem affects sales directly.

And in the case with Apple, reality is professionally managed toward "reality distortion field" of uneducated masses who are addicted to "latest tech" and "social validation psychology".

I don't know any other corporation which can comfortably keep silence on issues like NSO/Pegasus or just "postpone" intrusion on user privacy as CSAM.

People love their shiny toys. This is exactly the dynamic with tobacco companies in the past. People believed in one point in time that cigarettes are "healthy things, recommended by physicians". https://edition.cnn.com/2017/05/24/health/gallery/tobacco-he...

It is always psychology first, technology second. Or sales and shareholders first, services and tech appliances second.

You can thank "geniuses" like Edward Bernays and his contemporaries for this.

If Apple wants to insist that they need to have a fully integrated and exclusive AppStore because of "security", then they should be held accountable for security issues. E.g. money-back guarantee at a minimum, and preferably compensation for lost data etc.

While I think Apple can do better, that argument about the App Store doesn’t follow. By analogy: insisting that property follows fire safety regulations doesn’t make governments responsible for arsonists.

Maybe not if you interpret it strictly. But if Apple doesn't respond timely to exploit reports, then they can be liable for resulting damages.

I’m absolutely in favour of GDPR-scale fines for failures to fix security critical issues in a timely fashion.

by analogy, when companies make claims that their products are something they're not, they are responsible.

https://www.inquirer.com/business/law/london-grenfell-highri...

https://www.reuters.com/article/us-britain-fire-lawsuit/u-s-...

Tesla's Autopilot comes to mind too.

Real autopilot is much dumber than Tesla's Autopilot, because it doesn't include autothrottle or autobraking mechanisms, it cannot avoid obstacles or change course to avoid collision with another plane (it's separate system). You will have hard time in a court trying to defend your position.

https://en.wikipedia.org/wiki/Autopilot

The average consumer has no knowledge of that use of the word autopilot.

It's the only use of the word «autopilot». There is no other uses. Tesla Autopilot is just a product name, like Microsoft Windows. Will you sue MS for false advertising just because user need to use a knife to actually open a window on the laptop screen? MS «Windows» just paints rectangles on a screen.

The term you linked to is specific to aviation, from your link "An autopilot is a system used to control the path of an aircraft". When it comes to Law, at least here in the UK, you will often see the term "Reasonable person". The position that a "Reasonable Person" would assume "AutoPilot" automatically pilots the car would not be hard to defend as it's not reasonable to assume any person who may use 'autopilot' is familiar with the technical capabilities of an unrelated aviation system...

> By analogy: insisting that property follows fire safety regulations doesn’t make governments responsible for arsonists.

Rather: if Apple enforces a monopoly on selling fire extinguishers, these should better be really reliable.

"By analogy: insisting that property follows fire safety"

Terrible analogy, are you really company operating in 'free market' setting T&C to a sovereign nation passing laws?

Why shouldn’t I?

Firstly the causality is the same even if the ultimate power and available sanctions are different. The nations can “just ban hacking” the way they can “just ban arson”, and then go “oh no it’s still happening” while locking up hackers and arsonists; or they can say “fire safety on all domestic products” and then it’s harder to set fires, which isn’t much different in causality than a big box store making exactly the same requirement for all the products they sell.

Secondly, sovereign nations have been mostly fairly relaxed about the businesses creating and enforcing Ts&Cs, and can always overrule those Ts&Cs as and when they change their minds.

I think a better analogy would be if the government prevented anyone else from having their own fire extinguisher or non government fire departments. If they prevent anyone else from protecting themselves or seeking alternative means of protection, yes they would be responsible if they do not prevent ALL fires.

This was a very clear explanation of some very serious problems with Apple and the app store. Users who think Apple iOS is secure and private--as Apple keeps explicitly claiming--will be very sorry if their life or well-being depends on being able to have private data.

What really galls me is hoops i have to jump through and the money I have to spend to install my own apps written for my own use on an iOS device. How can that be for my own security? The ability to write a program for a computing device is such a fundamental capability, how can a device that lacks this ability even be sold?

It is free to run your own apps on your own device and has been for many years now.

Oh? I though I had to buy a $99 developer account,and connect the device with my account to be able to build it and install it. I guess I missed something important in the docs.

I worked on my first app for a year before getting a developer license and uploading it to the app store. I had no trouble installing it on my device. You missed something.

You can only install three such apps, they expire every seven days, and they cannot use important features such as push notifications (or include Network Extensions, which notably means you can't write an obfuscating VPN app to help people bypass firewalls in countries such as China).

There are many entitlements that the free account can’t have. There are also other provisioning profile management bugs with free accounts that apple hasn’t fixed.

Anything that requires access to Apple's service – TestFlight, push notifications, Game Center, etc will require payment. If all you want is to stick an app on your phone that's free (as of ~5-6 years ago?).

There are limitations. The signature on the binary is only valid for 7 days I believe, so naively you'd have to rebuild/reload every week, however there are certainly automations that do this for third party apps with a little daemon running on your Mac in the background, and I suspect there are equivalent automations for your own apps/open source codebases to reduce the hassle.

So "free" but still a lot of hoops to jump through. For android I just plop down an apk (like a normal OS).

No, it used to be like that but not anymore. If you want your own app on your own phone to last more than 7 days you need to buy the $99 membership.

“have you heard about any kind of security problems with Android recently? I haven't.”

That’s a pretty silly thing to say [1] and a non-argument. Whether or not you’ve personally heard about security problems with android doesn’t mean they don’t exist or aren’t widely known to others.

[1] https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

Flubot

According to Zerodium, iOS exploits are cheaper than Android exploits because iOS exploits are so plentiful[1][2] in comparison.

It should also be noted that the #1 vector for malware installation on Android is the Play Store itself[3].

The issue isn't Apple or Google's mobile app distribution implementations themselves. The issue is that the app store model was only adopted because of its profitability, and security was an afterthought. Despite this, the companies' PR departments try to paint the app store model as necessary for "security" and then fall short of actually securing things because that might cost money or decrease revenue. There's no competition, so who is going to stop them or force them to improve?

[1] https://www.theregister.com/2020/05/14/zerodium_ios_flaws/

[2] http://zerodium.com/program.html

[3] https://www.zdnet.com/article/play-store-identified-as-main-...

They said that two OS versions ago, pre-Blast Door and the other improvements Apple made (not that those helped against Pegasus, of course). Have they started buying iOS exploits again?

>According to Zerodium, iOS exploits are cheaper than Android exploits because iOS exploits are so plentiful[1][2] in comparison.

On the other hand if your iPhone is vulnerable it will get an update. Can you say the same thing about Android?

Considering Samsung is the majority of Android phones, yes. They keep up and sometimes apply security updates faster than Google.

did you read the article, the author clearly states that Apple chose not to do anything for quite extended period of time.

Samsung has the greatest marketshare in the the Android ecosystem[0][1] and they've pledged to provide security updates for 4 years for >130 models[2] – which is pretty good!

[0] https://www.appbrain.com/stats/top-manufacturers

[1] https://www.statista.com/statistics/271496/global-market-sha...

[2] https://arstechnica.com/gadgets/2021/02/samsung-now-updates-...

Their 4 year support from phones initial release is still quite bad and the last year is apparently only quarterly not monthly updates. So buy a phone X months after release and you get 36 - X months of monthly security patches and then minimal support for 1 year.

That’s a big deal because their manufacturing last years model S20 and many people are buying not realizing it’s apparently got 1.5 years of full support remaining.

Apple does basically the same thing. You buy an older iPhone like the XR and you get years of support off. Hell they cutoff support for the 6th gen iPod Touch less than 6 months after they stopped selling it. They also make zero support promises for their products or monthly updates. While you might get 7 years like an iPhone 6S, it could also be 3 or even 2 like the original iPad. It's completely at their whims. For a while Mac support seemed relatively stable but Big Sur dropped a ton of models.

Samsung's support pledge isn't perfect but it is an improvement that will hopefully lead to other Android OEMs stepping up their game.

The 6s still gets support, and even though it gets iOS 15 iOS 14 will continue to get security updates for people who stay on it. Hard to believe that the XR is going to get dropped within the next 5 years.

That’s a good first step, but.. I mean, I can’t be the only one here who has daily driven a single phone for longer than four years, right?

This is from the same person that reported iOS vulnerabilities recently: https://news.ycombinator.com/item?id=28637276

Thanks for all the work.

So static analysis will not catch private API usage, so is mostly useless for protecting the users, it is interesting that such a rich company could not hire a team of competent developers to produce an actual secure way to give applications(and users) access to the private APIs.

Does Linux/BSD sandboxing system offer such protection?

Android uses SELinux by default to sandbox apps since v5[1], Linux/BSD have several forms of sandboxing[2], and the most common is probably AppArmor offered by Ubuntu and other distros. A few support SELinux as well.

[1] https://source.android.com/security/selinux

[2] https://en.wikipedia.org/wiki/Linux_Security_Modules

> com.apple.developer.pushkit.unrestricted-voip

Do Duo, Otka, or Microsoft Authenticator have the special notification entitlement? These notifications never seem to be delayed no matter what internet climate i'm in unless i'm literally in the middle of nowhere.

I only download Apple apps that needs no additional privilege nor sends any telemetry back somewhere.

Did I do that one right?

Reply on news.ycombinator.com