Slashdot Mirror

← Back to Stories (view on slashdot.org)

Lawsuit Claims Top iPhone Games Stole User Data

Posted by Soulskill on from the shake-up-and-down-to-send-credit-card-details dept.

pdclarry writes "Storm8, a maker of some top iPhone games, allegedly stole users' mobile phone numbers, according to a lawsuit filed on November 4. The suit claims that best-selling games made by Storm8 contained secret code that bypassed safeguards built into the iPhone to prevent the unauthorized snooping of user information. There have been other reports of applications copying personally identifiable customer information in the past. The complaint seeks class-action status."

19 of 149 comments (clear)

  1. Big Surprise... by Super+Dave+Osbourne · · Score: 3, Insightful

    Is it a real surprise that there are iPhone apps out there that snoop, and bypass safeguards. When will encrypted data at the 2048 and higher bit level make it into the tech we take for granted on a daily basis. If you want safeguards, folks need to start using the stuff out on the market that is free to give them some level of protection against theft. Don't lock the door well, expect thieves, don't weatherize in well, expect to get cold. Don't encrypt your data, expect to lose it to theft.

    1. Re:Big Surprise... by Quantos · · Score: 5, Insightful

      We have to be on guard for this behavior with computers, why are people surprised that it happens with mobile devices? That brings one question to mind though. Do they not verify the applications that are put up on their store?

      --
      Some people are only alive because it's against the law for me to hunt them down and kill them.
    2. Re:Big Surprise... by E+IS+mC(Square) · · Score: 5, Insightful

      >>What's to stop a bad application from bypassing those safeguards?

      Whatever happened to Apple's policy of babysitting their users by allowing only certain apps? Wouldn't this application exactly the kind of crap users should be protected against?

      It's been claimed on /. by appple apologists that that's the way apple protects its users. But apple is actually doing is protecting its pockets by banning applications which takes business away from them or AT&T - while such apps are in the wild - blessed by Apple.

    3. Re:Big Surprise... by SleepyHappyDoc · · Score: 5, Insightful

      Encryption wouldn't help here. The API allows access to all kinds of data on the iPhone, which some apps do legitimately require in order to function (for example, a Google Voice-type app would indeed need the user's phone number). Even if the data was encrypted, the iPhone would happily decrypt it and pass it to the app when given the proper API call. The issue here is enforcement. Developers caught doing this kind of thing should be banned from the App Store, and put on some kind of blacklist at Apple so Apple doesn't do further business with them.

      --
      Stasis is death. Embrace change.
    4. Re:Big Surprise... by R3d+M3rcury · · Score: 3, Insightful

      So Apple will try but they may make mistakes. Fair enough.

      But if we accept the fact that mistakes will be made, how is this better than either a "Wild West" approach where anyone can publish applications with no review whatsoever or, conversely, a competitive store approach where some stores will be better than others about evaluating what an app does?

    5. Re:Big Surprise... by jo_ham · · Score: 2, Insightful

      No, you just made a claim about "appple apologists" [sic] that you completely failed to back up. You then threw out your own baseless accusation, again with no citation.

      Textbook flamebait.

      You can replace "Apple" with "MS" or "Sun" or "Verizon" or "Amazon" or "Google" for exactly the same mod result.

    6. Re:Big Surprise... by sjames · · Score: 2, Insightful

      Apple would receive no blame at all here except that they claim to protect users from this sort of thing. In order to provide this "protection", they make developers of potentially useful apps jump through a series of flaming hoops, yet managed to defeat the entire point by allowing the Storm8 games right in. That is, they endorsed the app by screening it for harmful behavior, pronouncing it good, and then offering it in their app store.

      It should be no surprise that if Apple will claim to be providing this protection and then fails to do so, they will catch some heat over it.

      If they had left things open and the same thing happened, instead the comments would be a mixture of "that's what happens when you install random binaries you download from the net" and calls for Storm8 to be treated just like a script kiddie would be if caught. Apple would be left out of it because they neither produced nor endorsed the apps.

      Storm8 proclaims that the data collection was a bug rather than deliberate. If so, that just makes it worse for Apple's claims that they must screen all apps for their user's own good.

    7. Re:Big Surprise... by sjames · · Score: 2, Insightful

      They've had since at least August 27th to correct their oversight (the date when Storm8's behavior was first documented publicly). Considering that it could be verified by just installing one of the listed games and running tcpdump while registering it, I'd have to say they haven't been at all interested in investigating.

      Just to add to it, Storm8 doesn't even deny that the collection happened! They only deny that it is intentional.

    8. Re:Big Surprise... by Anonymous Coward · · Score: 1, Insightful

      Data encryption is just not practical within US boarders, our government is just too paranoid and nosy. Law enforcement will demand backdoors be required (such as CALEA, the Communications Assistance for Law Enforcement Act), and if there are backdoors built in for them to use then hackers and unscrupulous businesses will use them too.

      Also no device using encryption can ever be offered for export, ITAR (International Traffic in Arms Regulations) forbids it, attempting to leave the USA with an iphone with encrypted data on it is exactly the same as attempting to smuggle out a nuclear weapon (in the eyes of the law anyway).

      The only way to stop these scumbag businesses from snooping is to have actual consequences for getting caught. I'm not talking about a slap on the wrist and a little fine either, I'm talking about long prison sentences for company executives. Only once there are actual consequences with this activity stop.

      Remember, if YOU were caught doing this then you would be sitting in lockup (with no bail) right now awaiting trial on multiple criminal felonies.

    9. Re:Big Surprise... by Antique+Geekmeister · · Score: 2, Insightful

      When will a pony show up and dance the lambada? This has _nothing_ to do with the length of encryption keys, and everything to do with fine-grained data access. Unfortunately, a lot of apps were developed first, and security only thought of later. (Yes, I'm talking about CVS and Subversion and Jabber.) The results are predictable: personal data is not encrypted, and is shared freely to the local filesystem because the developers are not given the time, and the apps are not given the resources, to protect the data more thoroughly.

      This data _should not have been accessible_ to unauthorized applications, true. But encryption in limited hardware like an Iphone is painful to provide at all, due to the speed and space limitations. 2048 is hardly necessary: most such data lives in plain-text, because the authors believe that its your operating system's problem, not yours. (Go look at Subversion's storage of plain-text passwords to see where this leads.)

    10. Re:Big Surprise... by DavidTC · · Score: 2, Insightful

      Exactly.

      Apple is playing both sides here. Either their app store is safe, or it isn't.

      If it isn't safe, 90% of their excuse for not allowing people to download apps from anyone is nonsense.

      --
      If corporations are people, aren't stockholders guilty of slavery?
  2. Re:Clearly an inside job. by SchroedingersCat · · Score: 5, Insightful

    They don't have access to the code. Besides, reviewing the code requires non-trivial technical skills. They are checking that apps conform to certain standards. If somebody really wants to plant backdoor into their app then nothing can realy stop them. There must be an explanation for 10000 fart apps in the store. Perhaps some of them have VOIP client built in...

  3. yeah, right! by Anonymous Coward · · Score: 5, Insightful

    To be fair, given apple's reputation of 'protecting' their users by banning apps for all and sundry stupid reasons, it's only fair to lay the blame on the company for failing to protect against this.

    You can't have the cake and eat it too.

    But of course, if it's apple - apparently they can, at least here on /.

    1. Re:yeah, right! by Dare+nMc · · Score: 2, Insightful

      I would agree, except apple's setup seams to prevent anyone but apple being able to prevent this. Most other platforms you could install a debugger/logger, but that would be banned on any phone that can access the app store. In a open development environment you could have open source apps that the customers can compile themselves insuring any suspicion can be verified in source as intent, again not option in the apple environment. Apple better have a terms of use for application developer so that these suppliers are are in-deed punishable by apple. Since again, the customer only deals with Apple for the applications, it seams to me, Apple should be the first ones to sue these developers, since they are likely to take the most damage from this.

    2. Re:yeah, right! by DJRumpy · · Score: 2, Insightful

      No play for play software producer would open the source on their currently selling software. At a minimum, should the charges prove true, I would think Apple will yank the app (potentially all apps from that vendor I would think). This is a pay app, not a free one.

      I would also think that legal action, both by individuals, and by Apple is pretty much a given should it prove to be true.

    3. Re:yeah, right! by MightyMartian · · Score: 2, Insightful

      One of the chief rationales constantly given for Apple's labyrinthine and bizarre rules is to protect the "experience". If Apple is allowing malware in their store, then I think they should taken to task for screwing with the "experience".

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    4. Re:yeah, right! by MightyMartian · · Score: 3, Insightful

      I'd love to, but sadly, I think it shows the sheer ineptitude of their apps store and undermines the very arguments they use for denying things like full C64 emulators. In short, Apple's excuse is a pile of bullshit. If malware can make it on to the iPhone via the Store, then one of the Store's primary purposes has been undermined, as has Apple's claims about it.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    5. Re:yeah, right! by brkello · · Score: 2, Insightful

      Eh, that's a load of crap. Apple spews us with ads on how much safer it is than a PC daily with their misleading commercials. But then, when they approve something that runs on an Apple device that steals your data, it's ok?

      If you are making the claim that you don't have to worry about viruses and bad people on Apple products, then you better not be sanctioning apps that do exactly that. If they let anyone put anything on the iPhone, this would be different. But since they force you to go through their approval methods, people are going to expect more from them. You can't let them have it both ways.

      --
      Support a great indie game: http://www.abaddon360.com
  4. Re:note to Apple by 140Mandak262Jamuna · · Score: 3, Insightful

    mass-adoption is a security liability. it must be feared as much as holes and bugs in software. how does it feel to be in Microsoft's shoes? go ahead, fanbois. mod me down.

    Oh, really? Take a look at the market share of Apache webserver. Now which is more secure? IIS or Apache? They are plump target for every organized crime outfits in the world. They host banks and brokerage accounts that transact trillions of dollars day in day out. And the organized crime outfits don't limit themselves to simple hacker techniques. They would not mind murder and kidnapping and bribing to get passwords or breaking and entering to install key loggers. In that market place Apache shines and IIS lags.

    Mass adoption alone is not a security liability. Mass adoption of closed proprietary protocols, be it Apple, be it Microsoft, be it Diebold, is a security liability. The reason is the main interest of Apples and Microsofts and Diebolds is to sell more of their product. Not security of user data. It is important only as much as it affects sales. If there are other factors that influence sales they will be the preoccupation of these companies, not security of user data.

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact