App Auto-Tweets False Piracy Accusations

An anonymous reader writes "Certain iPhone and iPad applications from a Japanese company have broken software piracy detection mechanisms that are sending out tweets on the user's own Twitter account, saying, 'How about we all stop using pirated iOS apps? I promise to stop. I really will. #softwarepirateconfession.' The trouble is, it's sending these out on accounts of users who actually paid up to $50 or more for the software and who are legally using it. The app is asking for access to users' Twitter accounts, but does not give the reason why it is asking, so the author of the article concluded (rightly) that things were being done deliberately. Would you want your legally purchased software to send out messages to all of your contacts on Twitter or on other social networks saying that you were a software pirate? Would you excuse the writers of the software if it was just an error in their piracy detection measures?"

Comments

no

[Anonymous Coward]

no

Re:no

[mwvdlee]

-1 tl;dr

App permissions

[danomac]

Generally if I have an app asking for Twitter/Facebook credentials and it appears completely unrelated to the app I just remove it and move on.

Re:App permissions

[Anonymous Coward]

Not using Twitter/Facebook also solves that problem.

Re:App permissions

[cjpa]

This app cost 50$ and it was only when the user got an update, that the app insisted on getting Twitter credentials. So he paid heavily for an app which subsequently sent out a dodgy update. Not a very nice practice.

Re:App permissions

[Anonymous Coward]

Yes, but it's a fucking Dictionary. It doesn't *need* Twitter. It doesn't matter who wrote it, or how many good reviews it has.

Re:App permissions

[green1]

You don't honestly believe that bit about the walled garden protecting the users do you?

Re:App permissions

[Nexion]

Actually that solves MANY problems.

Re:App permissions

[fustakrakich]

If you don't use Twitter/Facebook, you're obviously hiding something.

Re:App permissions

[EGSonikku]

As an iOS user since the original iPhone I have a few points to make.

Firstly, part of me wishes it were more open and that's why I've always used available jailbreaks.

Secondly, when one looks at the amounts of malware available for each platform it does become clear that the 'walled garden' does seem to have an affect on device security.

It really is a double edged sword, but I can see the merits of both arguments.

Re:App permissions

[Hatta]

Exactly. The article asks if this mistake is forgivable. The mistake isn't even the problem, that the app asks for permissions that it doesn't need is already a deal breaker.

Re:App permissions

[dgatwood]

If I were one of those folks, I would follow these steps to register a complaint with Apple. Just saying.

Re:App permissions

[danomac]

I didn't actually realize it was a dictionary - people actually pay more than a buck or two for an app? Considering a dictionary is available online, $50 for a dictionary app seems to be kind of silly.

Re:App permissions

[Threni]

I noticed one of these twitter posts from Teller (the silent half of Penn and Teller) earlier today. I assumed it was a joke that I didn't understand, but it makes sense now.

I'm more than willing to make a statement in court to the effect that I assumed he was admitting to performing illegal acts if it helps in any subsequent lawsuit against the turd-like cretins who abused people's trust in their products by misrepresenting them publicly in this way.

Re:App permissions

[tftp]

Considering a dictionary is available online, $50 for a dictionary app seems to be kind of silly.

Perhaps not to a journalist who earns his daily bread by reviewing applications for portable devices. It's one of his tools of trade.

The Web site approach that you talk about may work if you need one word in a month. However the browser is not a perfect interface. You need to scroll around, to zoom in, to zoom out... even a simple application that has only one input field and one output area will be a huge timesaver. This is important for journalists who routinely write articles, especially when those articles are in a foreign language (Norsk != English.)

Re:App permissions

[dbIII]

However in this case it's malware people paid for without understanding that it's malware. That one nasty step beyond Bonzi Buddy.

Re:App permissions

[Em Adespoton]

If you don't use Twitter/Facebook, you're obviously hiding something.

...and that's a Good Thing.

Re:App permissions

[TFAFalcon]

Yeah, he must be a serial killer or something.

Re:App permissions

[Dahamma]

Unless it's a class action, in which case he'll get a $5 coupon towards purchase of another broken app and the lawyers will get the rest.

Re:App permissions

[farble1670]

Secondly, when one looks at the amounts of malware available for each platform it does become clear that the 'walled garden' does seem to have an affect on device security.

okay, so you are now admitting that there is malware on iOS? that's a big step. so, from now on, your argument is going to be that there's less malware on iOS?

Re:App permissions

[tftp]

/me borrows a journalist's hat: "We, journalists, are writers, not readers!"

Re:App permissions

[Entrope]

In this case, MAC = Mandatory Access Control, and the GP was right.

Re:App permissions

[R3d M3rcury]

However the browser is not a perfect interface. You need to scroll around, to zoom in, to zoom out... even a simple application that has only one input field and one output area will be a huge timesaver.

I can't speak for Japanese dictionary sites, but dictionary.com's mobile site is pretty straightforward--no pinching or zooming required.

Re:App permissions

[EGSonikku]

In fact, when searching for articles on iOS malware this is what one finds:

http://www.mactrast.com/2012/11/report-android-gingerbread-most-malware-prone-mobile-os/

"much still remains to be done before Android users can sleep as soundly as iOS users do."

and:

http://www.forbes.com/sites/andygreenberg/2012/07/05/researchers-say-iphone-users-hit-with-app-stores-first-ever-spam-sending-app/

The first EVER spam app hit the iPhone just this year - and was very promptly removed from the App Store.

"Just as antivirus researchers congratulated Apple for keeping the iPhone free of nasty apps five full years after its release, spammers seem to have finally tarnished that spotless record."

So I think it's fair to say that while not perfect (and who is?) that iOS has really done a remarkable job keeping the malware off it's platform. Android has gotten better and I freely admit that, and it's a good thing. But it's definitely not up to snuff quite yet compared to the competition in that particular area.

Re:App permissions

[xaxa]

I visited China recently, and paid £10 or so for Pleco. Its great:handwriting recognition of Chinese characters, OCR using the camera, and many more plugins I haven't paid for. All offline, I'd have used £10 many times over in roaming fees with an online app or site.

An app that's "all in one" doing something similar could easily be worth $50.

Re:App permissions

[SomeoneGotMyNick]

It's kind of like that post-login "Wall" you can write on when you do your daily dial-up into the "Old Geezer BBS" :)

Legal liability

[Lisias]

This is character assassination.

You know that old joke about crying "FIRE" in a crowded theater? The bottom line is that you must be damn sure the place is really catching fire before doing that.

The software owner should be legally charged.

Re:Legal liability

[Intrepid imaginaut]

I'd expect a few libel suits in lieu.

Re:Legal liability

[Anonymous Coward]

It's yelling "movie" in a crowded firehouse

Re:Legal liability

[darkshadow88]

This is textbook libel.

Or rather dictionary libel.

Re:Economics

[sjames]

None of that is applicable here. The app is hijacking the users twitter credentials to falsely claim that they are pirates.

Even if I accept for the sake of argument that DRM is OK in general, I see two major ethical problems there.

Re:Who would pay $50 for an iOS App?

[EGSonikku]

Flamebait much? People pay far more than that for desktop apps. People tend to think that an iOS iPhone or iPad app is going to always be some simple thing, and a lot are. But there are plenty of higher end "desktop quality" apps available on the platform.

Granted I don't personally believe a Dictionary app would be, but hey, an app is worth what people are willing to pay.

Back to the topic of what's triggering these erroneous piracy messages, there could be a couple of things at play. Some people are reporting its happening on Jailbroken devices that also have the "Install0us" app installed, which is to be fair used solely for app pirating. It may be the app sees "Hey, I'm on a hacked device with a pirate store installed" and assuming it itself has been pirated for that reason.

However, other users are reporting the same issue on non-jailbroken devices which leads me to believe that these apps were targeted for iOS 5.1.1 and may be seeing the massive backend library and OS changes Apple made for iOS6 and incorrectly assuming its running on a Jailbroken devices due to unexpected OS differences.

I'm not defending the app maker for obviously going overboard on anti-piracy measures, just trying to figure out the 'why' of it being triggered for paying customers.

Re:Economics

[RocketRabbit]

How do we know it is falsely claiming that the users are pirates? The guy in the link admits to using Installus which is an application specifically crafted for piracy. Maybe he pirated it, maybe he didn't, but who likes to admit to being a criminal even when busted red-handed?

Boycott app stores

[KiloByte]

There's a simple solution: never install programs from an untrusted source, such as an app store. A source that's trustworthy has the sources you can download and read -- and if any such a logic bomb is found, it can be removed immediately -- not that code with such a bomb should be really allowed back without a thorough review. This possibility makes such sabotage virtually absent in free software.

Re:Boycott app stores

[Anonymous Coward]

http://notanumber.net/archives/54/underhanded-c-the-leaky-redaction

Evil code can look completely simple and benign. You would never catch this kind of shit reviewing an app's source code. At some point, you just have to trust the developer.

Re:Boycott app stores

[VortexCortex]

So, if you were reviewing the code for an app and found some sneaky logic, you'd just remove it and proceed to use the app anyway?

Yes. We wouldn't have had Unix without its C compiler...

FTJF

Historically, back doors have often lurked in systems longer than anyone expected or planned, and a few have become widely known. Ken Thompson's 1983 Turing Award lecture to the ACM admitted the existence of a back door in early Unix versions that may have qualified as the most fiendishly clever security hack of all time. In this scheme, the C compiler contained code that would recognize when the login command was being recompiled and insert some code recognizing a password chosen by Thompson, giving him entry to the system whether or not an account had been created for him.

Normally such a back door could be removed by removing it from the source code for the compiler and recompiling the compiler. But to recompile the compiler, you have to use the compiler — so Thompson also arranged that the compiler would recognize when it was compiling a version of itself, and insert into the recompiled compiler the code to insert into the recompiled login the code to allow Thompson entry — and, of course, the code to recognize itself and do the whole thing again the next time around! And having done this once, he was then able to recompile the compiler from the original sources; the hack perpetuated itself invisibly, leaving the back door in place and active but with no trace in the sources.

The Turing lecture that reported this truly moby hack was later published as “Reflections on Trusting Trust”, Communications of the ACM 27, 8 (August 1984), pp. 761--763 (text available at http://www.acm.org/classics/).

You see, the behavior of which you speak is in the very definition of "back door". With the source code available, it's actually possible to compare the expected compiled binary to the resulting binary. If you're talking about some cleverly hidden in plain sight vulnerability we just call those "bugs", and carry on. Deliberate bug infested additions rarely persist beyond refactoring and further contributions. Eg: Only about 2% of Linus' original code remains in the Linux kernel due to code churn. Not that I suspect such foul play, but it would be pretty hard to coordinate a persistent threat in open source code unless the code rarely changes.

Re:Boycott app stores

[Splab]

Really? So you have sat down and read through every single line of code in everything you use? Or are you just believing some creature out there is doing that for you and hoping to god they spot the problems?

Regardless...

[klingers48]

...Of whether or not the user has pirated the software, this kind of name-and-shame digital vigilantism on the part of the software author is just playing with fire. Especially (but not only) when it's shoddily coded and hitting false positives.

I can imagine them sitting around their dev table brainstorming "Ok guys, what's the best possible way we can open the company up to libel and defamation lawsuits? Hey, I know... Let's even give people who use and rely on Twitter as a business tool an opportunity to claim commercial losses against us as a result of an automated piracy accusation going out to their X-million followers!"

Sometimes things just aren't thought through very well...

Misrepresentation

[Anonymous Coward]

The app is posting a tweet purporting to come form the user, whereas it actually comes form the app's author. As the app's message is implying that the user is violating copyrights, a crime, this is defamatory, so the author of the app is libelling the user. The user isn't a public figure, so doesn't have to prove malice on the part of the app's author. As I see it, the only defence for the app's author would be to prove that the user did illegally copy software.

Re:Misrepresentation

[tftp]

As I see it, the only defence for the app's author would be to prove that the user did illegally copy software.

It wouldn't be even nearly enough. For example, an ISV cannot set fire to your house upon detection of unauthorized use. There is a specific limit to what software developers may do when they have a good reason to suspect piracy. Have a look at Microsoft's solution - MS had enough lawyers thrown at the problem, so what MS did is basically the maximum of what is legal and safe.

In this case the software developer committed several crimes. And those crimes do not even PREVENT the piracy! What would prevent it? Simple: just don't run the software! Or run it in demo mode. Good solutions are numerous.

One good advice that got overlooked here is this: always maintain good communication. Talk to the user. Let the user always know what is happening. Let the user make his decisions. In this case the software bypassed the communication phase and decided to become not only the detective, but also the judge, the jury and the executioner. Note that only a judge can order a convicted offender to publicly humiliate themselves. This rarely happens, but such sentencing does occur now and then - usually as an offer that can be refused (if you like the inside of a prison more, for example.) This software took upon itself the right that rare a human is entrusted with.

The company's name is Enfor. Ask for a refund.

[Anonymous Coward]

Seriously, would it be so hard to include that in the article?

The company you want to avoid from now on is called "Enfor", and they deserve to have this bullshit rubbed in their face. If you want to sock 'em in the gut, email Apple and explain to them what happened after you legitimately purchased the app, and ask for a refund. I'm sure this is breaking one of their SDK rules somewhere, but even if it isn't- they have a walled garden to protect legitimate users from this kind of crap. When stuff like this gets past them, it makes Apple look bad as well as the company who wrote it.

So email Apple and tell them how you feel about this betrayal of trust. Tell them the app has publicly humiliated/embarrassed you, that you want a refund, and that this whole situation has shaken your confidence in Apple's walled garden. If enough people do this, Apple will turn around and tear a strip off Enfor- either by freely issuing refunds to anyone who asks for it, or by taking down the offending apps (goodbye sales!), or by banning the developer.

Re:The company's name is Enfor. Ask for a refund.

[Sponge Bath]

The companies name is Enfour, not Enfor. Enfor Consultants (www.enfor.com) is a different company.

Re:Economics

[tftp]

How do we know it is falsely claiming that the users are pirates?

Because at least one instance of a false positive is known. The guy has the receipt. Nothing else matters; the guy is not a pirate.

The guy in the link admits to using Installus which is an application specifically crafted for piracy.

How does that change the fact that the guy has paid his dues with regard to the dictionary? Even if he pirated all other applications - which he denies - this doesn't give the dictionary a right to accuse the owner of anything. Besides, the guy claims that he needed Installus for a legitimate purpose: " you can use it to go back to an older version of an app you legally own. This is otherwise impossible in iOS."

I wouldn't of paid $50 for the app

[Nyder]

and everyone that knows me knows I pirate software, music, movies, whatever. In fact, I'm the go to guy.

See, I tell people I pirate software, so no, the app wouldn't bother me.

But it goes to show, the only people that buy dvd/bluray's are the ones who get hit with DRM and warnings about copyright, because I sure as fuck don't get those when I download pirated versions.

You buy goods because you like the abuse. I pirate the goods because I don't like to be abused.

Re:I wouldn't of paid $50 for the app

[mumblestheclown]

No, you pirate becaus you dont like paying for things. The rest is pseudophilosophical rationalizaton.

Re:Looks like it might have been pirated after all

[flimflammer]

Except that he explained the reasoning for having Installous on a jailbroken phone, and others have rung in saying that Installous isn't what's flagging it, or the only reason.

Re:Who would pay $50 for an iOS App?

[_merlin]

When I'm in a country where I have severely limited vocabulary in the local language, a good dictionary application is one of those can't-live-without things that I actually do depend on for getting by. I haven't seen how good this application is/isn't, but I'd pay more than $50 for a great dictionary app. Also, a mobile version is more valuable than a desktop version. I know from experience what it's like pulling a notebook computer out of a bag when I get stuck trying to read a sign or communicate with a stranger. I'll give you a hint: it's not as practical as pulling a phone out of your pocket.

Enfour, Inc Oxford Deluxe dictionary app devoloper

[Stan92057]

There that's who they are! so claims the article.Don't buy their products and send them alot of pissed off customer emails. Let em know how ya feel.

Re:Looks like it might have been pirated after all

[c0lo]

Except that he explained the reasoning for having Installous on a jailbroken phone, and others have rung in saying that Installous isn't what's flagging it, or the only reason.

There is no rational for having installous on a jailbroken phone other that to install pirated apps.

TFA:

When Scanner Pro, which I also legally own, introduced a bug in the app that made the app stop working completely on my device. Installous lets you browse a list of available pirated versions of the app, which also means you can use it to go back to an older version of an app you legally own.

Does the above says something about your rational abilities? Naaahh... a simpler explanation exists: who the hell bother to actually RTFA?

Approved Malware

[Dan East]

I've been rather surprised at the porousness of Apple's walled garden. My iPad is 100% stock (not jailbroken, etc), and all of the apps came directly from the app store. A couple weeks ago I noticed some odd files in my dropbox root folder. There were two executables - one for Windows (Xbox 360 MSP Generator.exe.), one for OSX (IGenerate 6.7) - both for generating "free" XBox points. Fortunately Dropbox allows you to (via their web interface only) view the versions and history of files. Both those files came from my iPad. Then last week it happened again with just a windows executable (iLividSetup.exe), also from my iPad.

So some iOS app is interacting with the Dropbox app in some way (either via API or just throwing files into a folder that Dropbox must have all permissions open on). I have yet to determine which app it is. I only use 6 or 7 apps regularly, so I'm pretty sure it's not any of those, and I have yet to do a more systematic check on the other dozens of odd lesser used apps. The moral of the story is that these app stores are not foolproof by any means, and malware is still being approved, even if the attack vector is novel, dependent on a 3rd party app (dropbox) and is cross-platform.

Anyone else see this behavior in their Dropbox files?

Re:Looks like it might have been pirated after all

[c0lo]

<advocate client="devil"> Note that he does not "legally own" Scanner Pro as he claims, rather he holds a license which permits him to use it under certain conditions. I rather doubt those conditions include "download old versions from piracy apps", so he surely is using it precisely to violate copyright, or in the common parlance, "to install pirated apps", despite the apps not having been taken by force on the high seas.</advocate>

Copyright law: it's hilariously busted, but let's fix or eliminate it rather than making excuses for violating it.

<advocate client="devil"> I wouldn't be that sure he's using it precisely in the sense of copyright violation, his description of the problem admits a situation in which he actually has a license for a version that, upon upgrade, failed to work.
If indeed this is his situation, he has a license to use the application (perhaps even in its newer version, otherwise why try to upgrade?), but the application fails to be usable in his conditions. In which case, what he is doing is not illegal and maybe more pragmatical (than suing the provider for the lack of use).</advocate>

Maybe it pays to first look at (/get to know) the specifics of a situation before spitting blood in a fight with windmills.
Granted, addressing the sickness at the source is the actual solution (anything else being palliative) - even though the big but is if you can afford it.

Re:Who would pay $50 for an iOS App?

[MrEdofCourse]

" the "Install0us" app installed, which is to be fair used solely for app pirating."

No it's not.

It's also one of the easiest (and in some cases only) way you can revert to previous versions of apps. I don't pirate apps on iOS, and I rarely have a use for Install0us, but a couple of times it's saved me when a newer version of an app was unusable and Install0us was the only way to get a previous version re-installed and running again.

In the spirit of being fair though, ya, it's mostly for pirating, but I wouldn't jump to the definitive conclusion that someone who has it on their iOS devices is pirating apps.

Re:Who would pay $50 for an iOS App?

[ArhcAngel]

This is a much better example than Photoshop. What's hilarious is the Vuvuzela app is $200 but the same company offers their universal translator app for $5.99

Re:Who would pay $50 for an iOS App?

[Stolpskott]

A very quick search (quicker than responding to your post) has turned up a list of 15 apps in the range of $150 to $999.99, none of which is Photoshop but all of which are worth the purchase price to the user who is really REALLY going to use any of those apps.

Re:Who would pay $50 for an iOS App?

[Anonymous Coward]

My boring anecdote.

Traveling on I-87 northbound and we got stuck in traffic. Stop and Go snail pace traffic.

Out comes a shiny glittering wonder of the world iphone with a 50$ map/direction/traffic application. "This is the BEST EVAAAR, DUDE!" the guy said. "Let me get us out of here". Everybody rejoiced. Alas, the joy did not last long. The app had no idea about the current traffic that we were sitting in.

Out comes an android. Not so shiny, mind you. It had this free little known map application called Google Maps. Not only it showed the "red" lines for next 20 miles, it also showed all the small roads with few of the "green" ones. Lo and Behold - we were out of the traffic and on our way.

The dude is now using his shiny iphone with the latest and greatest mapping app EVAAR called Apple maps. Oh the irony!

Re:Who would pay $50 for an iOS App?

[psmears]

where I have severely limited vocabulary in the local language, a good dictionary application is one of those can't-live-without things

If you're trying to expand your vocabulary, throw the dictionary in the trash and get a thesaurus.

...and how does that help when you don't even know one synonym in the target language?

And I have no idea why you'd pay $50 for a dictionary app when you could just buy the actual paper dictionary for $20.

Clue: a good multilingual dictionary weighs several pounds. Installing an app adds no extra weight. When travelling to/around a foreign country, that can be important :-)