Reasons why Apple should add "Gift This App" to iTunes
mobileorchard.com
mobileorchard.com
Let us suppose I am J. Random Black Hat Hacker, and I am in possession of a zero-day iphone exploit.
How do I get it into lots of people's hands?
Solution: write an innocuous-looking amusement app (with the exploit buried inside it), get it past Apple's testers (this is the some magic happens here stage, but from what we're hearing they don't do a hell of a lot of testing), and once it's in the store, voila: "Gift This App"!
Note: the issue here is social engineering. Ordinary people take freebies, whether honestly come by or otherwise. Consider the penetration testing experiments where USB memory sticks with malware payloads are left in car parks outside office buildings; something like 40% of the sticks were shoved straight into a PC at work without any attempt to sanitize them. "Gift this App" can be used by bad guys to provide the illusion that their targets are getting something worth having for free -- the same illusion that 419 scammers exploit.
At the very least, developers should need prior approval before being able to use "Gift this App" -- or there should be a mechanism to warn recipients that the App is from a source not connected with them.
Many people proceed on the assumption that the sticker price on front of an item defines its value. If you price a widget at $199, they may look around to see if they can find it for $189 at a competitor's store, but they don't say to themselves, "hey, wait a minute, given the likely bill of materials, shouldn't this sell for $30?" They take it on trust that price reflects value, to a first approximation.
(Incidentally, this is a major problem facing the adoption of free software, because it works in reverse: "if it's free, doesn't that mean it's not worth anything? So why should I bother with it?" We know what's wrong with this argument, but many non-geeks don't.)
If you want to social-engineer an exploit, I'd say making it look as if the trojan is valuable is going to help more than making it look as if the trojan is free because of the psychologial association between cost and desirability.
(Hence all those "Your computer is at risk, buy our virus scanner now!" scams cluttering up your clueless cousin's web browser.)
If you're a serious criminal and you've found a way to empty someone's bank account via their iphone, I'd say it was worth paying $10 per victim to get a better supply of victims by convincing them that your malware client is valuable and worth installing. Right?
As non-US based developers we can't even give coupon codes to our beta-testers. Those codes only work in the US.
And in Canada you can't even use iTunes gift cards for buying apps so the only way we can reimburse beta-testers is by sending them money by paypal.