First iOS Malware Discovered In Apple's App Store 171
New submitter DavidGilbert99 writes "Security experts have discovered what is claimed to be the first ever piece of malware to be found in the Apple App Store. While Android is well known for malware, Apple has prided itself on being free from malicious apps ... until now. The app steals your contact data and uploads it to a remote server before sending spam SMS messages to all your contacts, but the messages look like they are coming from you."
No doubt... (Score:4, Insightful)
Some will say that the Apple App Store is "no longer secure." This is ridiculous. It took 5 years for the first malware to show up...that's pretty damned good. Nothing is impermeable, after all. But the real value is that the malware can easily be removed...and its source eradicated. So it's not only about keeping malware out via the App Store, but also in having a swift and flexible response option for just this sort of occasion. Good security fails gracefully and a good defense in depth allows for easy recovery, and it looks to me like Apple meets those criteria.
Re:No doubt... (Score:4, Insightful)
Re:First *malware* perhaps (Score:4, Insightful)
...but years ago there was a tethering app disguised as a flashlight app so it's been possible for a long time.
A tethering app is malware... but only according to Apple.
For their users, it's an extremely useful piece of software.
Re:Not surprising... (Score:5, Insightful)
Yeah, this is fixed in iOS 6. Separate prompts for Location, Contacts, Calendars, Reminders, Photos, and after the fact you can see who requested it, who currently has access, and toggle them.
My only complaint is that the App Store doesn't give you this information before you download the app. Developers should have to declare that they want to access any of these things (and show ads, and have in-app purchases), and the App Store listing should contain the information about what the app is going to want to do before you buy it.
Re:Trouble in paradise (Score:4, Insightful)
Well it was sneaky the way it got threw. In general what the App does in its description required it to pull all this data off your phone. Then it needed to send the data to the cloud to match the correct name to get their phone number. Thus, it seemed to do what it says with a normal code review.
Re:Apple approval process (Score:4, Insightful)
It would be more accurate to say one got caught. There could be others running wild that have slipped the net.
Re:No doubt... (Score:5, Insightful)
Some will say that the Apple App Store is "no longer secure." This is ridiculous.
Right, it would be more accurate to say that it never really was "secure", it was just heavily audited. It shouldn't be a surprise to anyone that malicious apps will manage to sneak through the audits from time to time.
Re:No doubt... (Score:5, Insightful)
Some people tend to have an all-or-nothing nature, especially when it concerns something they go partisan over - like Apple.
I've easily had dozens of arguments over the years where I argued Apple was the more secure solution for the average user, people responded with pwn to own or some such, and if I argued further, they just labeled me as a "fanboi" as if that ended the argument even if I argued the Unix underpinnings. Nevermind that I use W7 and Ubuntu myself, or that it's my own personal experience having to play tech support to an entire tech-challenged family that's both hardworking and lucky enough to afford to have a choice. Sure, I could put them on OpenBSD or HardenedLinux, but the first obstacle they run into, they say "Why can't I do yadayadayada" they'll go and find a way to install Windows on it, which is perfectly fine by itself, and start downloading mouse icons that look like toy trojan horses and what not.
The mindset of Y turns out to not be perfect, so it's on the same level of X, must originate from politics because the whole feel of the debate seems political. It's a retarded mentality to have, akin to cheering for wrestlers and their bogus storylines. It's sad that it has crept into tech so pervasively and that's what the whole last decade felt like on any issue - stupid partisan cheerleading for one side or the other, or booing against one side or another.
The truth of a walled garden is that it's the most practical solution for most consumers, who really don't or can't police what they're doing. I wouldn't want to live in one exclusively, nor would most geeks, but that's why they're geeks, they go above and beyond the artificial constraints and don't need the protection.
Meh (Score:3, Insightful)
Re:No doubt... (Score:5, Insightful)
it's not nearly the first ios app that sends contact infos off the phone for no particularly good reason.
android well-known for malware? (Score:5, Insightful)
While Android is well known for malware,
in theory, and not in practice that is. the *only* thing that makes android more vulnerable is apple's more severe vetting for apps in their store, and the fact that android apps can be "side loaded", or installed from arbitrary sources (other than the google play store). side loaded is disabled by default and must be explicitly enabled by the user after subjecting them to a scary warning dialog.
android security model of fine-grained permissions that are presented to the user before the app is even installed is superior to iOS. what android doesn't do is protect users from their own stupidity. read the permissions. if you choose to go ahead and install that flashlight app that requests permission to the internet and to read your contacts, you'll get what you deserve.
Re:No doubt... (Score:4, Insightful)
One answer would likely be tiers:
The first tier would be actively approved apps.
Then, if the user so chooses to set foot into Mordor, there can be a tier of apps that are downloadable almost immediately, and pulled if people justifiably report it as malicious.
This type of system has worked on jailbroken phones, where the App store serves one tier, and Cydia serves another. Since it takes a little bit of effort to JB an iPhone, generally someone is clued enough to be able to watch out for Trojans.
What this is protecting against, is arguably the biggest security hole of all; the user. Most smartphone users are not anywhere as savvy as a /. reader. The casual user will see an app that might offer "cool smilies", install it by reflex, and go on their merry way. On iOS, the damage a user can do is limited [1]. On Android, it is fairly easy to find apps that are malicious, and where a competent person would not install a fleshlight app that asks for full phone, GPS, contact, photos, and filesystem access (or even a prompt for a su), an inexperienced user will just click "install" nontheless, then scream that Android is insecure when they get bitten. iOS is designed to keep this from happening. Only beta code, Cydia apps, and enterprise apps are not coming through Apple's gateway. It is almost certain that the worst an iOS app can do is lighten the user's pocketbook due to its cost, or the cost of in-app transactions.
This isn't exactly the "dancing bunnies" security hole, but protecting the ignorant user from themselves is the difference between a platform having a rep as secure versus easily compromised.
I like both worlds. Have some barrier so a user doesn't exit the managed tier without a deliberate decision, then if they choose to, allow them to do what they want. This keeps the novices from footshooting while allowing people with a clue to use their device to the fullest.
[1]: Assuming the user doesn't JB, but generally if someone is clued enough to jailbreak, they will either know what they are doing, or end up having a clued friend DFU restoring their device and not do it again.
Re:No doubt... (Score:5, Insightful)
it's not nearly the first ios app that sends contact infos off the phone for no particularly good reason.
Very true...but despite my best efforts to raise awareness, Facebook has yet to be classified as a very large botnet :)
Re:Trouble in paradise (Score:3, Insightful)
This isn't malware (Score:4, Insightful)
The application is working as advertised, uploading data as allowed by the user.
The problem is that the company is not trustworthy for what it does with that data. This can be any company: Do you trust Google, Yelp or Facebook with your data? This is the decision you have to make with any app on any platform. Pretty much the only way around this would be for Apple to require privacy and data use policies with minimum protections for all developers, and then require them to be bonded against a misuse contrary to that policy.
Re:First *malware* perhaps (Score:0, Insightful)
Like Facebook grabbing your whole contact list and uploading to their servers?
Fuck Facebook for pulling stuff like this, and fuck Apple for allowing anyone grab personal data and use it for who knows what. That's one of the reasons I will never buy an iPhone or any iThing again. At least Android tells me what an application tries to do, so I decide not to install it.