Slashdot Mirror
Lawsuit Claims Top iPhone Games Stole User Data
pdclarry writes "Storm8, a maker of some top iPhone games, allegedly stole users' mobile phone numbers, according to a lawsuit filed on November 4. The suit claims that best-selling games made by Storm8 contained secret code that bypassed safeguards built into the iPhone to prevent the unauthorized snooping of user information. There have been other reports of applications copying personally identifiable customer information in the past. The complaint seeks class-action status."
Is it a real surprise that there are iPhone apps out there that snoop, and bypass safeguards. When will encrypted data at the 2048 and higher bit level make it into the tech we take for granted on a daily basis. If you want safeguards, folks need to start using the stuff out on the market that is free to give them some level of protection against theft. Don't lock the door well, expect thieves, don't weatherize in well, expect to get cold. Don't encrypt your data, expect to lose it to theft.
Then what kind of app DOES Apple reject?
As strict as the Apple store is about getting actual useful apps in, and screening all kinds of apps based on one or two system calls, clearly the only way this could have happened is if Storm8 has someone on the Apple App Approval Team who they know. Otherwise, how would something like this have gotten past such a stringent code review?
Reeses
Getting access to a user's phone number doesn't require a 'secret' code. Any app can do that.
http://blog.timeister.com/2009/06/25/objective-c-get-iphone-number/
To be fair, given apple's reputation of 'protecting' their users by banning apps for all and sundry stupid reasons, it's only fair to lay the blame on the company for failing to protect against this.
/.
You can't have the cake and eat it too.
But of course, if it's apple - apparently they can, at least here on
there was me thinking that apple were just a very well marketed firm, one that makes money from sad people who need to express themselves with shiny lifestyle choices.
who'd have thought that they allow this kind of sinister thing to happen!!!!! can they be trusted with your data at all?
maybe this is why the business crowd won't go near the iphone, apart from the battery life, the dropped calls etc.
How is using standard, documented, code bypassing safeguards?
NSString *telnum = [[NSUserDefaults standardUserDefaults] stringForKey:@"SBFormattedPhoneNumber"];
On most devices - at least those that were activated via iTunes - that will return the phone number. Or null if you're on an iPod Touch.
Okay, so the developer shouldn't have been harvesting this data, and definitely not without protecting it, but I fail to see how this was bypassing safeguards!
google was able to push private api's in the google iphone app.
other apps were able to by pass the no streaming over 3g by putting a unseen area to touch to enable 3g streaming.
the only thing the approval process does it what apple wants in terms of type of app on its phone.
mass-adoption is a security liability. it must be feared as much as holes and bugs in software. how does it feel to be in Microsoft's shoes? go ahead, fanbois. mod me down.
Isn't it that it is all right for your carrier (ATT & Verizon) to sell your phone records (Amdocs) to anyone who has a couple of bucks? How dare these little players get into this game. Next thing you know is that customers might start thinking that their financial records are their alone and not the property of their financial institutes. I keep reading more and more about how the 4th Amendment does not apply to records stored on servers, only to records that are physically located in your house. Next thing you know, attorney client privileges will be the property of the attorney who will charge you even more if he has something really incriminating.
The complaint seeks class-action status
Even if the "class", um, "wins", it would be something like this; Lawyer gets well paid for all the hard work to bring justice to the world.
iPhone users get a coupon for a free iPhone download or two.
This issue is a bit more complicated than you think.
You can get device id (often the number) on games/apps from a variety of carriers. We're contractually bound only to use it for reporting back to them. Esp for subscription games. There's that line about sharing info with our partners in nearly every privacy clause, basically we use it to track you but not to market to you.
And yes I've worked in the industry for a while.
As a recent convert to Apple (short story OS X is a nice balance between Unix and applications I need to use for my client base) I was a little shocked by how nonchalant Apple seems to take user security.
/I've strapped on my fire-proof britches... fire away :)
1. MacBook's default to no user authentication which is unacceptable for a portable device that can be stolen or misplaced.
2. The OS X Firewall is disabled by default. Let's assume every OS X component is 100% secure, there's no way that every OS X app is.
3. And as a completely random example... AppleTV only supports WEP. I know this is a nit-picky thing but it shows Apple's indifference. WEP has been thoroughly and completely broken... yet one of Apple's primary devices will not support a more secure protocol. You want to use your new toy you have to downgrade your security.
I like OS X and the new unibody MacBooks just rock... but Apple's shwarmy and basically indifferent attitude to security is going to end up biting them in the arse.
If your phone is jailbroken. I do not know if it protects the user form this company, but it does block information that other companies have been known to try and get. Yet Apple is still trying to convince users that the App store is the only safe place for software.
Their app review process and tight control over the apps (both the epitome of stupidity IMO) make them a prime candidate to be named as defendant. Have not RTFA but hope they get the sued and lose big time for their arrogance. Fuck Steve Jobs.
Hope is the currency of fools
MacBook's default to no user authentication which is unacceptable for a portable device that can be stolen or misplaced.
Are you sure about that? Every new Mac I've seen, you have to set up a user account (with password) first. Are you talking about how there is a setting to log you in automatically on restart?
The OS X Firewall is disabled by default. Let's assume every OS X component is 100% secure, there's no way that every OS X app is.
This makes no sense. No ports are open by default, so just what would the firewall be, well, firewalling? With no ports open by default it's pretty much pointless to target any of the services since so few of them are likley to be turned on across the population. That's actually the real reason we've seen no viruses on OS X, because there's no target vector wide enough to be worth the trouble - thus all attacks are trojan style.
If a particular app has a flaw how does a firewall help, if that app choses to listen on a port? Wouldn't it have to do that around the firewall anyway?
And as a completely random example... AppleTV only supports WEP
As stated by other posters, this is not correct.
I like OS X and the new unibody MacBooks just rock... but Apple's shwarmy and basically indifferent attitude to security
I disagree here, I think Apple has been very security conscious in the ways that actually matter most to users.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
google was able to push private api's in the google iphone app.
This is false, it was found to simply be a notification they listed to, not an unpublished call they made. When the system calls you, that is not misuse of a private API.
There have been other groups that have snuck use of a few marginal API calls past app testers, but they are cracking down. And as other people noted, you can use the public API's just fine to get at the phone number.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Well, when I use my "locator" on a 3rd-party apps, then the phone asks me if it's OK the first time around. If it's using an actual API then building a "safelist" and having it ask before sharing other private data shouldn't be so difficult. For a non-jailbroken phone, jailing the apps aware from that private data and requiring the API should make such things pretty hard to get away with.
Oh noes! My IP address is on the internets! Slashdot must have stoles it! Money please... I mean... lawsuit! Lawsuit!
Purchasing an application on a *mobile phone* - and then complaining that the purchaser knows who you are is, quite frankly, brutally retarded.
That idiot who wrote the SFGate article is a shit-eating hypocrite.
Because in order to comment on his site, you have to register. To register you have to provide an email address, zip code, age and gender.
THERE IS NO REASON TO REQUIRE ALL THAT INFORMATION.
From - http://yro.slashdot.org/comments.pl?sid=1386337&cid=29585841 - every phone OS has ways to get the phone number, much easier than various little hacks to do so. Android, Symbian, Blackberry OS, Windows Mobile. Though to Symbian's credit, you need to do a few tricks (like waiting for a phone call), and Android requires permission.
The interesting question is, how many apps on those platforms already call home? Why is Apple "innovating" in revealing what could be standard practice elsewhere?
What really concerns me with the iPhone is that there is no control for net access.
While every application using GPS must be confirmed internet access is possible.
I would like to see something like a an app-whitelist to manage that.
Turning the data-modes off in the preferences is imho very inconvenient, but of course is
the most secure solution.
Sad thing is, the best companies on mobile security (telling from Symbian), Kaspersky and F-Secure won't ship any products to a target of "jailbroken" (hacked) iPhones as they want to maintain a relationship with Apple.
App Store is absolutely impossible since these things run daemons at background, including an app firewall.
So, even if you pay, you won't have any kind of extra privacy or security on iPhone.
PS: I got couple of their games, they have "recruit" feature which pulls up Address Book contacts and sends "invitation" to them without using the built in smtp. One must be real stupid not to get suspicious while REVIEWING the game. App Store approving idiot: I am talking to you.
An application installed on your iPhone "in principle" runs in its own sandbox, but it is quite possible to access, say, your photos. I could write a game which uploaded all your personal photos to my website while you were playing it.
Apple does not check source code. You provide a compiled binary for their review. Accessing stuff outside of your application sandbox *may* get your app rejected, though. I say *may*, because I wrote an iPhone game which used the standard wallpapers as a background. Version 1.0 was accepted. I added ad-support and made it free, resubmitted it as 1.1, and got rejected because I used "Apple copyrighted images". Note that this part of the application wasn't changed at all from the 1.0, accepted version. I pointed dout that the app didn't contain *copies* of those images at all, and that I simply accessed /Library/Wallpapers (paraphrased). After that, I got a mail from the reviewer saying it's not allowed to access data outside my apps sandbox, so it stayed rejected. I then added a few photos to the installer from my own personal photo library and resubmitted. The app then got accepted.
It would probably be a good idea if trying to upload data would trigger an end-user popup, just like accessing the current location (GPS coordinates) currently does. If you hadn't just selected "upload my high-score to the internet", the pop-up would be suspicious and you'd reject it.
On the other hand, the app could simply upload your personal photos while pretending to upload your highscore.
A better solution would probably be to use POSIX permissions to make things unreadable by default, and use the "UAC-style popup" to grant specific permissions. A photo editor which asks to read your camera roll makes sense, but some game probably doesn't have any business there.
Note: I'm not currently doing anything evil, apart from serving ads. I realize that probably is evil enough for the people reading /.
"Have storm8 pulled their games as they all show in a search but they cannot be downloaded.
I get the following error message:
The item you are trying to buy is no longer available
I can download other apps but no storm8 games?"
It means app is pulled from store either by Apple, Storm8 or some court order thing. I still think we should blame the right guys for this, App store and Apple (SDK).
App Firewall does have a nice function where it scans for "listening" (server) applications and pops up when some new listening application (server) launched, asks user whether to allow and sign the binary against future modification which in that case, it will popup again.
They are absolutely stupid to code such a "mac like" app firewall and not enabling it by default. As a good side effect, it could also promote developers sign their apps.
BTW: Check your ports with nmap locally (nmap) or remotely (grc.com) after putting machine to DMZ. Some real needless ports are always open. I am not suggesting we should all run "stealth", it is just they keep that freaking port 88 open, they keep listening via SMB when you basically share a printer etc. Does everyone have to have a damn Windows machine on their networks?
I don't know if they are doing it like this any more, but all storm8 apps are the same game with different graphics.
1. Connect to storm8 server and send your phone number + imei
2. Server returns a session id you can use for processing your commands
3. basic http queries control the app
This is why when the games first came out you couldn't move your account from one device to another, they used the device id as your user id. They have since implemented portable username but by default they still send all your shit across the network. You can snoop packets and see the phone number of every user that plays on your network.
I wrote a lot of bots for all the games. I haven't played in a few months... Setup an http proxy in your iPhone network settings and all this is very obvious.
Do they not ask for your code as you do a request to be included into the apple iphone app store, then if anyone really bothered to read the code and what it does, such is the job of a security analyst at their submissions department, then they would have caught this code, and would not have allowed such a game to be inserted into the iphone to begin with.
They have a process making it hard visibly only for coders to get their apps in, but guess what, each subsequent version upgrade, should go through the same rigorous process. This is Apple's fault only, and user's should be compensated for the lack of follow through on Apple's side.
Oh, well, now I don't trust Apple anymore, good thing, I was just about to go get myself an iphone too, guess I will just stick with my palm treo.
Nifty way to offer technical support to people who whine about something in the iTunes App Store, but never seek technical support.
>> Storm8, a maker of some top iPhone games, allegedly stole users' mobile phone numbers, according to a lawsuit filed on November 4
If this is true, I will post the cheats I made for all the Storm8 games (since they all use the same backend). This will end them.
In the meantime, since nobody else hijacked this thread, it's time to mod me into oblivion:
Kingdoms Live code: y7595v
iMobsters code: p4cq9c
Racing Live code: 5bycax
Vampires Live code: cycvbv
Rockstars Live code: 7da3pt
World war live code: uhpt7s
Zombies Live code: x2q779
Ninjas Live code: k73w4
-- I was raised on the command line, bitch
Just another reason to use an OPEN SOURCE phone OS!
This is from Apple's letter to the FCC, regarding why they rejected / delayed the Google Voice app:
We created an approval process that reviews every application submitted to Apple for the App Store in order to protect consumer privacy, safeguard children from inappropriate content, and avoid applications that degrade the core experience of the iPhone. Some types of content such as pornography are rejected outright from the App Store, while others such as graphic combat scenes in action games may be approved but with an appropriate age rating. Most rejections are based on bugs found in the applications. When there is an issue, we try to provide the developer with helpful feedback so they can modify the application in order for us to approve it. 95% of applications are approved within 14 days of their submission.
If you want a bricked iPhone, there's an app for that you can't refuse.
If you want an exploding battery on an iPhone, there's an app for that.
Here at Crapple, we strive to give you a crappy overpriced product for you fudgepacking, twinkie sucking snobbish faggots out there that have more money than sense.
Steal your User Data ? There's an App for that!
Symbian S60 3rd (and now 5th) Edition require all native apps to be digitally signed with a developer certificate that has to be bought from their site, and you can't sign up to purchase from a generic webmail account. Different types of certificates grant different permissions to the application for access to user data and handset features like SMS,calls, bluetooth,wifi, GPS etc.(
The handsets also block unsigned applications from being installed, so this also deters casual piracy (since a cracked Symbian application would not have the developer certificate).
Of course, if you're determined, there are utilities to hack the phone's keystore and insert your own certificate there (which can be used to sign the cracked apps that you get.
The bottom line is, this approach works fine for regular users who wouldn't mess around with cracked apps, and yet there's no need for any approval process.
Apple may talk of the end user 'experience', but that should be upto the end user. There are people who overclock their GPUs, replace and tweak their cars' engines and so on, well aware of the risks of screwing up as well as the fact that it voids their warranty. I don't see why such an EULA shouldn't work for Apple. Let those who want to use the Appstore use it, let others who wanna hack the firmware do it and void their warranty.
"..One hosts to look them up, one DNS to find them, and in the darkness BIND them."