Slashdot Mirror
Lawsuit Claims Top iPhone Games Stole User Data
pdclarry writes "Storm8, a maker of some top iPhone games, allegedly stole users' mobile phone numbers, according to a lawsuit filed on November 4. The suit claims that best-selling games made by Storm8 contained secret code that bypassed safeguards built into the iPhone to prevent the unauthorized snooping of user information. There have been other reports of applications copying personally identifiable customer information in the past. The complaint seeks class-action status."
Is it a real surprise that there are iPhone apps out there that snoop, and bypass safeguards. When will encrypted data at the 2048 and higher bit level make it into the tech we take for granted on a daily basis. If you want safeguards, folks need to start using the stuff out on the market that is free to give them some level of protection against theft. Don't lock the door well, expect thieves, don't weatherize in well, expect to get cold. Don't encrypt your data, expect to lose it to theft.
As strict as the Apple store is about getting actual useful apps in, and screening all kinds of apps based on one or two system calls, clearly the only way this could have happened is if Storm8 has someone on the Apple App Approval Team who they know. Otherwise, how would something like this have gotten past such a stringent code review?
Reeses
Getting access to a user's phone number doesn't require a 'secret' code. Any app can do that.
http://blog.timeister.com/2009/06/25/objective-c-get-iphone-number/
To be fair, given apple's reputation of 'protecting' their users by banning apps for all and sundry stupid reasons, it's only fair to lay the blame on the company for failing to protect against this.
/.
You can't have the cake and eat it too.
But of course, if it's apple - apparently they can, at least here on
How is using standard, documented, code bypassing safeguards?
NSString *telnum = [[NSUserDefaults standardUserDefaults] stringForKey:@"SBFormattedPhoneNumber"];
On most devices - at least those that were activated via iTunes - that will return the phone number. Or null if you're on an iPod Touch.
Okay, so the developer shouldn't have been harvesting this data, and definitely not without protecting it, but I fail to see how this was bypassing safeguards!
mass-adoption is a security liability. it must be feared as much as holes and bugs in software. how does it feel to be in Microsoft's shoes? go ahead, fanbois. mod me down.
skype, opera, flash, and c64 emulators
You can get device id (often the number) on games/apps from a variety of carriers. We're contractually bound only to use it for reporting back to them. Esp for subscription games. There's that line about sharing info with our partners in nearly every privacy clause, basically we use it to track you but not to market to you.
And yes I've worked in the industry for a while.
As a recent convert to Apple (short story OS X is a nice balance between Unix and applications I need to use for my client base) I was a little shocked by how nonchalant Apple seems to take user security.
/I've strapped on my fire-proof britches... fire away :)
1. MacBook's default to no user authentication which is unacceptable for a portable device that can be stolen or misplaced.
2. The OS X Firewall is disabled by default. Let's assume every OS X component is 100% secure, there's no way that every OS X app is.
3. And as a completely random example... AppleTV only supports WEP. I know this is a nit-picky thing but it shows Apple's indifference. WEP has been thoroughly and completely broken... yet one of Apple's primary devices will not support a more secure protocol. You want to use your new toy you have to downgrade your security.
I like OS X and the new unibody MacBooks just rock... but Apple's shwarmy and basically indifferent attitude to security is going to end up biting them in the arse.
If your phone is jailbroken. I do not know if it protects the user form this company, but it does block information that other companies have been known to try and get. Yet Apple is still trying to convince users that the App store is the only safe place for software.
MacBook's default to no user authentication which is unacceptable for a portable device that can be stolen or misplaced.
Are you sure about that? Every new Mac I've seen, you have to set up a user account (with password) first. Are you talking about how there is a setting to log you in automatically on restart?
The OS X Firewall is disabled by default. Let's assume every OS X component is 100% secure, there's no way that every OS X app is.
This makes no sense. No ports are open by default, so just what would the firewall be, well, firewalling? With no ports open by default it's pretty much pointless to target any of the services since so few of them are likley to be turned on across the population. That's actually the real reason we've seen no viruses on OS X, because there's no target vector wide enough to be worth the trouble - thus all attacks are trojan style.
If a particular app has a flaw how does a firewall help, if that app choses to listen on a port? Wouldn't it have to do that around the firewall anyway?
And as a completely random example... AppleTV only supports WEP
As stated by other posters, this is not correct.
I like OS X and the new unibody MacBooks just rock... but Apple's shwarmy and basically indifferent attitude to security
I disagree here, I think Apple has been very security conscious in the ways that actually matter most to users.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
From - http://yro.slashdot.org/comments.pl?sid=1386337&cid=29585841 - every phone OS has ways to get the phone number, much easier than various little hacks to do so. Android, Symbian, Blackberry OS, Windows Mobile. Though to Symbian's credit, you need to do a few tricks (like waiting for a phone call), and Android requires permission.
The interesting question is, how many apps on those platforms already call home? Why is Apple "innovating" in revealing what could be standard practice elsewhere?
I don't know if they are doing it like this any more, but all storm8 apps are the same game with different graphics.
1. Connect to storm8 server and send your phone number + imei
2. Server returns a session id you can use for processing your commands
3. basic http queries control the app
This is why when the games first came out you couldn't move your account from one device to another, they used the device id as your user id. They have since implemented portable username but by default they still send all your shit across the network. You can snoop packets and see the phone number of every user that plays on your network.
I wrote a lot of bots for all the games. I haven't played in a few months... Setup an http proxy in your iPhone network settings and all this is very obvious.
BTW: Check your ports with nmap locally (nmap) or remotely (grc.com) after putting machine to DMZ. Some real needless ports are always open.
But only if you have enabled some services, none of which are enabled by default. That's why it doesn't really matter, because any one service is going to have such a low surface area to attack it's a waste of time to write the exploit - in the general case.
Companies should always be more cautious because of the potential for espionage, but then they could insist that be turned on. For the average home user I still don't see it as a bad default because few people will ever enable the "sharing" items. An average home user will not share a computer from a desktop Mac, instead they'd be plugging a printer into a computer directly or sharing it via a dedicated device like an Airport Express.
"There is more worth loving than we have strength to love." - Brian Jay Stanley