Apple Yanks Privacy App From the App Store 136
wiredmikey writes "Back in May of this year, Internet security firm Bitdefender launched 'Clueful,' an iOS App that helps identify potentially intrusive applications and show users what they do behind their back, and giving users an inside look at all the information app developers can gather about a user. Seems legit, right? Apple doesn't think so. Or at least they have an issue with something behind the App that sparked them to pull it from the App Store. After initially reviewing and approving the App that was released on May 22, Apple has had a change of heart and has just removed the App from the AppStore. It's unclear [why it was yanked], and Bitdefender told SecurityWeek that the company is under NDA as far as explanations for the removal. Interestingly, Bitdefender did share some data that they gathered based on Clueful's analysis of more than 65,000 iOS apps so far, including the fact that 41.4 percent of apps were shown to track a user's location unbeknownst to them."
Apple is beside itself on this one. (Score:5, Insightful)
Sounds like Apple wants to be on both sides of their 1984 commercial. Not only do they want to be on the side that "is different" while being on the side that hates freedom and privacy.
Re:Apple is beside itself on this one. (Score:5, Insightful)
Re: (Score:2, Insightful)
Agreed... which if the average Joe valued his or her own privacy and freedom to control their own device, wouldn't be the side that makes billions of dollars a year. But unfortunately, Joe doesn't give a shit, so it is.
Re: (Score:2)
Well, at one point in the past there was Maemo whose apps generally didn't spy on you, and you had root access out of the box, and it was ahead of iOS on everything from cut and paste to multitasking.
"Maemo" is not a company and it was produced by Nokia which is, you guessed it, a company that makes billions of dollars a year.
Re: (Score:1)
Re: (Score:2)
God-Emperor Jobs
I just got an image of Jobs on a Golden Throne, being kept in a state of undeath by the sacrifice of 10,000 fanbios every day.
Damn you Games Workshop! :)
Re:Apple is beside itself on this one. (Score:4, Insightful)
Agreed... which if the average Joe valued his or her own privacy and freedom to control their own device, wouldn't be the side that makes billions of dollars a year. But unfortunately, Joe doesn't give a shit, so it is.
I seriously hope you're not referring to android here. Yeah, I want my phone to a direct feed into the servers of the world's largest targeted marketing multinational. I have an iPhone specifically because it lacks Google integration. If the average Joe valued his or her privacy as much as this, he or she wouldn't own a smartphone at all.
Re: (Score:1)
Re: (Score:3)
I'd be surprised if they used my information for "nefarious means", not only because they actually show me everything that's sent back to them, but also because that's not their business model.
Re:Apple is beside itself on this one. (Score:5, Informative)
You could, of course, use Android without the Google integration (quite possible) or simply Something Else Entirely, like Meego, Symbian, Bada, WebOS, Blackberry or whatever. Choosing the iPhone for your privacy is just plain moronic.
Re: (Score:2)
You could, of course, use Android without the Google integration (quite possible) or simply Something Else Entirely, like Meego, Symbian, Bada, WebOS, Blackberry or whatever. Choosing the iPhone for your privacy is just plain moronic.
Modded up without citation because you take the anti-Apple position. Look, smart phones are tracking you. Period. To pretend that somehow the iPhone is terrible and all those others aren't is just naive. Locking down the iPhone is at least as easy as locking down an Android phone. I would guess easier. Jailbreaking is not a difficult process, and from there, you can install nice things like Firewall iP. I would guess that this is FAR easier than getting a nicely working Android image without all goog
Re: (Score:2)
Hm, I guess you are a moron, and an Apple fanboi to boot, getting all defensive about Android, since it was one of six examples. Honest with yourself? No.
Re: (Score:1)
Take it easy. Everyone hates a sore loser.
Re: (Score:2)
" ...you pretty much have to forgo a smartphone."
should be
"...you have to forgo a cellphone."
Re: (Score:1)
>>>makes them billions of dollars
Doesn't Apple give-away lots of free apps? (Like how B&N and amazon give-away lots of free kindlebooks.)
Re: (Score:3, Insightful)
doy
sell someone an image to buy into and they become your slave
Apple has been selling an image for a long time, hence all the "Religion of Steve" jokes
rotten (Score:4, Informative)
Re:rotten (Score:4, Interesting)
Re:rotten (Score:4, Insightful)
Re:rotten (Score:4, Insightful)
The article raises the possibility that Apple did not like the Clueful app because it discloses to users that some developers are in fact evil.
Wouldn't that be a good way to weed out those developers? You're suggesting that Apple may prefer that people don't know which developers are the evil ones?
The most likely reason is that the app fell into a technical TOS violation
Why is that the most likely reason, as opposed to Apple just not liking the transparency that the app provides?
Perhaps because the app sends user data back to the developer?
Plenty of apps do that. Bitdefender says that 20% of apps they've studied send user data to the internet without notifying the user.
Let's not conjure up headlines.
What choice do we have? Apple put Bitdefender under a NDA regarding the removal, and Apple themselves won't justify why they did it unless they're basically forced to. We have no choice but to speculate.
Re:rotten (Score:5, Insightful)
We have no choice but to speculate.
Yep, and we should always assume the worst until they come clean. It's the only way to get a response.
Re: (Score:2)
Re: (Score:3)
We have no choice but to speculate.
Adding the NDA really fuels the Streisand effect behind that too. It suggests that the app does something, or comes too close to doing something, too powerful... They don't want an app out there that could sniff in-app purchase transaction data. The apps really ought to be totally fire-walled from each other, especially if whatever it monitored can be mirrored to a 3rd party remote location as well as reported to the user. It didn't say whether it just detected system calls or read actual data. I'm as
Re: (Score:3)
The most likely reason is that the app fell into a technical TOS violation,
I disagree. The fact that the details behind the removal was covered by an NDA somehow seems to indicate something deeper. Many apps are rejected and a few have been removed for TOS violations. I don't recall an NDA covering them. I'm interested in how Apple was somehow able to force an NDA over something like this. Do developers have to agree to something like this before submitting an app to the app store, or did Apple "suggest" that future submissions would not get approved if they talked about thi
Re: (Score:2)
Oh snap! Rotten Apple, that is their new name for me.
Re: (Score:1)
OK, I'll bite....
spit spit
Re:rotten (Score:5, Interesting)
This is probably nothing more than the app had to have broken out of its sandbox. There should not have been a way for the app to monitor what other apps were doing without doing something disallowed by Apple.
Not saying I don't want this app, or that some arrangement/exclusion shouldn't be reached by the two companies (perhaps with a code review to make sure everything they are doing outside of the sandbox is benign), but I don't think this is a big conspiracy.
Just simply Apple continuing in its tunnel vision of not allowing apps full freedom on its phone.
Would definitely install this app if it was brought back. Perhaps release code so we can install it ourselves?
Re:rotten (Score:4, Interesting)
That's kind of what I was wondering, unless the app is simply a searchable catalog of the apps they have previously studied.
I'm curious how apps get your location without your knowledge? The first time an app asks you're supposed to get the location services popup, and whenever your location is being accessed you're supposed to get the little location arrow in the status bar at the top of the phone.
As much as I love my iPhone, I'm glad to get Apple get embarrassed by some of this stuff. The fact that many games were taking your phonebook simply because they could and sending it to the developer's servers was insane.
Re: (Score:1)
Re: (Score:1)
I seriously doubt the NSA has anything to do with this.
This is more than likely developers complaining about their source of revenue drying up as people can no longer be marketed as products to the advertisers, and Apple saying okay okay we'll pull it.
If the NSA wanted, they could just turn on your cellphone mic remotely and eavesdrop [kde.org]
Re: (Score:2, Informative)
Re:Not what I signed up for (Score:5, Informative)
Even without the app, after I JB-ed my device and started running PMP (Protect My Privacy), and Firewall IP, two apps available from Cydia, it was an eye-opener.
I ran a news app. It connected to an insane amount of ad, behaviorial targeting, monitoring, tracking, and other sites that had zilch to deal with news, and all to deal with obtaining what the user has. Eventually, I just allowed it to connect to its own sites and blacklisted everything else.
I fired up another app. It didn't just want contacts, it wanted in one's music collection, and connected to all kinds of sites, none relevant in any way to what it was doing.
Apple needs to revisit iOS's security model. Because Apple does a damn good job at stopping most stuff before it gets on the App Store, it has kept people safe for a while. However, iOS's security allows an app to do what it wants to except delete pictures once it gets installed on the device. The only time a user would get prompted is if the device was using the GPS or was going to use notifications. Other than that, it could slurp the contact list and use the phone as an outgoing spam machine.
Re:Not what I signed up for (Score:4, Informative)
Access to contacts actually requires explicit authorisation too now. In the next software release anyway.
Most of the app developers probably don't know (Score:4, Insightful)
That the ad library they embed is tracking the user location.
Re:Most of the app developers probably don't know (Score:4, Informative)
If you embed iAds, it actually doesn't require your permission - as the setting controlling whether iAds is allowed your location is actually buried under Location Services > System Services (yes, the advertising is a system service). Third party advertising kits (AdMob, etc) do require your permission.
Re: (Score:2)
I figured it was implied. But yes, that's right. Presumably the BitDefender app only detected that location data was sent somewhere without considering where it went.
Sounds correct (Score:4, Insightful)
Of course, you understand this has nothing to do with privacy right? The app was pulled because it didn't conform to our freedom respecting terms & conditions.
That is, our freedom to collect all your data.
Cydia (Score:3)
Yargh! (Score:2)
It's unclear [why it was yanked], and Bitdefender told SecurityWeek that the company is under NDA as far as explanations for the removal.
But we're the tech community, dammit! We're going to assume the worst! Argh! Hate! Mbxpz! Grrr! Woof! Howl!
Re: (Score:2, Insightful)
So you think I should assume that Apple had my best interested at heart, and were protecting me from knowing too much?
Thanks! Glad I don't have to worry! Back to FOOTBALL!!!
Re: (Score:2)
Oh, yeah! I forgot that one! "Argh! Strawman! Grrr!"
Re: (Score:2)
Apple needs to explain, otherwise assuming the worst is warranted. And your insult to nerds was a bit flamebaitish, Mr. Fanboi.
Re: (Score:2)
Ooo! Good catch. Forgot that one, too. Fanboi labels for all who dare not agree!
And your insult to nerds
Oh, please. The geekverse has become an intellectual cesspit.
NDA What? (Score:5, Insightful)
What kind of NDA do they have that keeps them from saying why it was pulled? (or do they have a "fight club" NDA prohibiting them from talking about the NDA?)
Does Apple make every iOS developer sign an NDA, or only the security researchers.
Something doesn't add up here.
Re: (Score:3, Interesting)
The Federal government routinely (anymore) uses National Security Letters to shred the entire Bill of Rights, and one of the provisions of NSLs is an NDA. After the Patriot Act was passed, anyone violating that NDA risked going to prison. Today, they can just disappear.
I small a rotten fish, not Apple, at the core of this particular "incident", a rotten fish wrapped in an old Washington Post newspaper, if you know what I mean.
Re: (Score:3)
The Federal government routinely (anymore) uses National Security Letters to shred the entire Bill of Rights, and one of the provisions of NSLs is an NDA.
Before anybody gets too excited about this theory, from the second sentence in the article: "Dubbed 'Clueful' by Bucharest, Romania-based Bitdefender [..]"
Re: (Score:2)
Re: (Score:3)
I'm an iOS developer, and I didn't sign anything. I agree to specific conditions under specific terms, but there's no signature anywhere to prove it, thus the only consequence of violating such NDA would be to get banned. Furthermore, the NDA that I agreed to only has to do with Apple software, not with other apps. Finally, even if all iOS developers had to sign anything, nobody needs to be an iOS developer in order to analyze iOS apps.
Re: (Score:2)
What kind of NDA do they have that keeps them from saying why it was pulled?
Probably the kind of NDA that keeps them from saying why it was pulled. As in, "we're pulling your app, if you want to know why sign here."
Re:NDA What? (Score:4, Informative)
Well technically, the NDA has been dropped, but...
Relenting to pressure from the developer community, Apple has dropped the NDAs that developers were required to agree to when they submitted their applications for consideration on the iPhone App Store.
In a statement on its Web site, Apple states, "The NDA has created too much of a burden on developers, authors and others interested in helping further the iPhone's success, so we are dropping it for released software."
The previous version of the NDA [pcmag.com] required that a developer not discuss the reasons that its app may have been declined, and restricted developers from publicly rebutting Apple's refusal or dissecting the denial notification that Apple sent them. The revised NDA allows developers to publicly comment on the reasons their app was accepted or declined, and it allows developers to state that they've submitted an app for consideration--but unreleased software currently under review is still covered by the NDA, and Apple has asked developers not to comment on applications currently being considered for the App Store.
http://www.pcmag.com/article2/0,2817,2331498,00.asp [pcmag.com]
...but as the New York Times knows already (and every news outlet knows as well). There does not need to be an NDA in place for Apple to place you permanently in their penalty box [dailytech.com].
So I'd say the Bitdefender company definitely made the right call on this one, especially if it intends to have continued special access to the Apple ecosystem. The huge beast is quick-tempered and bears long grudges. It's best to say nothing that could potentially upset it.
Re: (Score:1)
Uunbeknownst? (Score:4, Informative)
including the fact that 41.4 percent of apps were shown to track a user's location unbeknownst to them.
Unless they're doing something shady with private APIs or the like, I don't see how this is possible considering an app has to ask permission to enable location tracking, and the user can both see which applications they've granted it to and which ones have used it in the last 24 hours by going to their general settings.
I think what they really mean is, "We have nothing to lose after having our app pulled, so let's burn bridges by pretending that user's don't explicitly give permission for location tracking and saying that every app that tracks location is doing it behind the user's backs."
Also, what's up with both links in the summary going to the same article?
preface: I'm not an IOS programmer... (Score:2)
... however, does an app HAVE to ask permission in order to enable that functionality? Up front, I would imagine that an attempt to access a feature via API call that the info box would automatically pop up to grant permission, but can this be suppressed? And further, if it can be suppressed, can the user input be mimicked or a bit set to say "the user is ok with this"?
This is just my tin-foil hat I-haven't-programmed-anything-since-my-old-Amiga rant, but it seems like it could be plausible.
Re:preface: I'm not an IOS programmer... (Score:5, Informative)
Yes, they have to ask. The prompt is generated automatically in response to their request for location data, as you suggested, and suppressing it would do no good, since apps are sandboxed, meaning that they have no other recourse if the user denies the prompt or never sees it in the first place. I'm not aware of any way around it, and I seriously doubt there's a way around that's in use by a double-digit percentage of apps but has not yet been discovered by Apple and eliminated.
Re:preface: I'm not an IOS programmer... (Score:4, Insightful)
The exception is if they have iAds embedded, as iAds has location services enabled for it specifically. He was probably seeing the results of the iAds system pulling location details so it can get location-based adverts.
Re: (Score:2)
The prompt is generated automatically in response to their request for location data, as you suggested [...]
Can you talk to the hardware?
I remember seeing iPhone apps way back when that appeared to do this in order to query information from the GPS like what satellites it was using, etc. It was awhile ago and maybe these were jailbroken apps...
Re: (Score:2)
Yes, an app MUST ask for permission ... but how many users read those popups?
"This app would like.." yes yes whatever, just shutup and let me fling birds at pigs!
Who's that? (Score:5, Funny)
Re: (Score:2)
That's Clueful, he fights for the iUsers.
and to be out of mod points, damn you MCP!!!!
In the know... (Score:3)
Does this mean the difference between Android malware and iOS malware is you know what information the Android malware is stealing?
Re: (Score:1)
Yeah but you don't even have the illusion that you can do anything about it. At the very least, iDevices give you the illusion of being able to disable location tracking on a per-app basis, and at best, they actually let you do that.
Apple Yanks? (Score:1)
Walled Garden (Score:5, Insightful)
I'm not at all unsympathetic, but that's what you get when you develop for a "curated" platform.
Has Apple got something to hide? (Score:1)
Just asking the obvious.
Re: (Score:2)
I find this kind of application of the verb "to support" as wrong outside of charity as I find the use of the term "to steal" when applied to copying. I'm not supporting anyone or anything by buying a product, I am paying money IN EXCHANGE for something I want.
Regarding your last
Re: (Score:2)
Fair enough.
But I like to think of it as two farmers selling peaches off their trucks along the road. One occasionally gives his dog a hard kick in the ribs for no good reason, while the other one occasionally reaches down and scratches his dog behind the ear and says, "good dog".
It's easy for me to decide which one gets my business.
Just a random thought (Score:1)
Re: (Score:2)
Apple adding a feature to their phone that makes the actions and transgressions of other apps much more transparent? No, I don't think anyone has seriously considered that.
Re: (Score:1)
Deja vu (Score:2)
all over again? [wifinetnews.com]
There's probably more one than write up in Slashdot, but I couldn't find the one I was looking for
Other reason for it being pulled (Score:3)
Apple don't typically allow you to snoop on what other applications are doing. Applications are supposed to be sandboxed to prevent this. I would assume that there's a far more mundane reason for banning this application - that it was doing things it wasn't supposed to be doing.
Re: (Score:2)
So let me get this straight: This app managed to break through the sandbox and present that information? And, back in May, somebody approved this!?
Gee, I wonder what other apps that aren't so blatant about breaking through the sandbox got approved...
Interesting (Score:4, Interesting)
Re: (Score:1)
A large portion of the 41.4 percent must relate to iAds?
Re: (Score:2)
If apps are somehow going around Apple's only way to access the GPS, they wouldn't be approved
Assumption:
very likely for doing things it shouldn't be doing
I think I'll stick with my definition.
Re: (Score:2)
It would be very hard for an app to get out of the sandbox without that being noticed. Under controlled conditions, noticing that would be trivial unless
Time to go... (Score:2)
If they are under NDA... (Score:2)
The only plausible explanation I see is that they were either hired by or are in negotiations with Apple. There is no other way Apple could force an NDA on them. The reason for pulling the app is probably the same as for pulling the original Siri app. Makes perfect sense for Apple to hire these people to help them screen apps, considering that they've both proven to be better at it than Apple themselves and that they're motivated.
Re:Sounds like scare-ware to me (Score:5, Insightful)
The problem with this sort of app is it is delivering information based on some probing and some guesses but has no idea what is being done with the information. Not knowing anything about Clueful I can only guess they are looking for API calls that would tend to indicate certain behaviors are present in an app.
The first caution therefore is that because an API call is present in an app there is nothing whatsoever to indicate when or how it is being used, if it is being used at all. Therefore we are talking about possibilities and potentialialities, not facts.
Emphasis mine. There is no problem with this sort of application. This is exactly the reason the application exists, to inform you that you have no idea what is being done with the information.
Seems like you're either a shill, or completely missed the point that such applications and users of such applications have a desire to know more (than apparently 40% of the other applications aren't telling).
Re:Sounds like scare-ware to me (Score:5, Insightful)
The problem with this sort of app is it is delivering information based on some probing and some guesses but has no idea what is being done with the information. Not knowing anything about Clueful ...
Not knowing anything about Clueful, you spend 5 paragraphs criticising the developers of that application for presenting information that may not be 100% correct. You need to look up the definition of "irony" and do it fast, because I feel a new one is in the making.
Re: (Score:1)
But immediately gets modded to the max. See "rotten apple" above.
Re: (Score:3)
Ignorance is no excuse for sloppy programming. If you're an App Developer, it's your responsibility to make a solid and secure app.
If you cannot make your app solid and secure (i.e. by eliminating random location checks) then the users deserve to know of your incompetence.
Re: (Score:2)
The first caution therefore is that because an API call is present in an app there is nothing whatsoever to indicate when or how it is being used, if it is being used at all. Therefore we are talking about possibilities and potentialialities, not facts.
Indeed. That is why this app is a good thing. If there are API calls in there that don't have any apparent relation to the app's purported function, then the developer had better be prepared to explain exactly why that call is in there, and what it is doing with the information. If they aren't doing anything with it, then they'd still better have an extremely good reason for pulling it, not "well, we might need it for future planned features". If they need the info in the future, then they adjust their
Comment removed (Score:4, Interesting)
Re: (Score:2)
Re:unbeknownst to them? (Score:4, Informative)
Not entirely. iAds can get your location without permission because it has a completely separate pre-approved entry under System Services to do it. So if the app uses iAds, it will appear to get your location without asking for it (even though only iAds has access to it).
Re: (Score:2)
Re: (Score:2)
Your completely unable to copy and paste? Guess the *tards are out in force tonight.
*you're.
Ah, irony. Not just a method of getting creases out of clothes.