Apple Cleaning Up App Store After Its First Major Attack

Reuters reports that Apple is cleaning up hundreds of malicious iOS apps after what is described as the first major attack on its App Store. Hundreds of the stores apps were infected with malware called XcodeGhost, which used as a vector a counterfeit version of iOS IDE Xcode. Things could be a lot worse, though: Palo Alto Networks Director of Threat Intelligence Ryan Olson said the malware had limited functionality and his firm had uncovered no examples of data theft or other harm as a result of the attack. Still, he said it was "a pretty big deal" because it showed that the App Store could be compromised if hackers infected machines of software developers writing legitimate apps. Other attackers may copy that approach, which is hard to defend against, he said.

Comments

Trusting Trust

[jeffb (2.718)]

Thirty-one years later, it's still worth reflecting on it.

Re:Trusting Trust

[AndyKron]

That definitely was worth reflecting on. Thanks.

Re:Trusting Trust

[140Mandak262Jamuna]

Ken Thompson concluded:

Acknowledgment. I first read of the possibility of such a Trojan horse in an Air Force critique [4] of the security of an early implementation of Multics. I cannot find a more specific reference to this document. I would appreciate it if anyone who can supply this reference would let me know.

Did anyone find the original document? May be Snowdon did?

Re:Trusting Trust

[gweihir]

Incidentally, that problem has been solved: http://www.dwheeler.com/trusti...

It takes some effort though.

Re:Trusting Trust

[jeffb (2.718)]

To be fair, when Ken Thompson gave his Turing Award lecture, he didn't have access to Slashdot anonymous cowards to explain the errors in his reasoning. He did the best he could with what he had.

Re:Trusting Trust

[macs4all]

To be fair, when Ken Thompson gave his Turing Award lecture, he didn't have access to Slashdot anonymous cowards to explain the errors in his reasoning. He did the best he could with what he had.

Mods: That was INSIGHTFUL, not Funny (although it is a bit humorous of an observation).

Hard to defend against you say?

[Anonymous Coward]

Then what, pray tell, is the point of Apple's byzantine approvals process?

Re: Hard to defend against you say?

[Anonymous Coward]

What?

Re:Hard to defend against you say?

[thesupraman]

So that apple can act as a strict gatekeeper to maximise its profitability?
What other purpose would it have?

Re:Hard to defend against you say?

[phayes]

That's easy enough for everyone to figure out: It gives iOS users a more secure environment than the farce that is android today without imposing more than a tiny hardship on the vast majority of it's users.

I don't see this as being a major problem for iOS after this incident. Other than laziness there is no good reason for people to get their Xcode anywhere else than apple (as Xcode is a free download). AppDevs have now been warned that Xcode must be inviolate if they want to avoid their apps getting banned.

Now, what exactly was it that stopped you from making this simple deduction? Zealotry in favor of a rival platform perhaps?

Re:Hard to defend against you say?

[sociocapitalist]

Then what, pray tell, is the point of Apple's byzantine approvals process?

Money.

Re:Hard to defend against you say?

[AmiMoJo]

The usual method of getting developers to install a backdoored version of an IDE is to make them think they are downloading the legit one. Infect their computers, MITM them. The NSA/GCHQ have many ways to do that, and few developers bother to check file signatures (do Apple even offer them?)

So far there is no evidence that the Apple way works any better than the Google way. Google scans all apps for malicious code, the same way that Apple does. You don't think that Apple employs people to decompile and check app manually, do you? If a human is involved at all, they are just there to make sure that the UI and content meet the Apple standards. Most apps don't appear to be human reviewed at all, or if they are the humans pay little attention and allow apps with zero functionality, or which clearly contravene the rules (e.g. there is a Playboy app, despite the prohibition on porn).

The idea that Android is somehow riddled with malware is nonsense. Where are the vast botnets that would exist if it were? The Play store seems to be just as safe as the Apple app store, from a user's perspective.

Re:Hard to defend against you say?

[Wrath0fb0b]

The usual method of getting developers to install a backdoored version of an IDE is to make them think they are downloading the legit one. Infect their computers, MITM them. The NSA/GCHQ have many ways to do that, and few developers bother to check file signatures (do Apple even offer them?)

Not only does they offer signatures, but the infected version of xCode will be refused by default unless you modify the default Gatekeeper setting. This is all the more ridiculous because you don't even need to register to download the legit xCode directly from Apple. And of course it's protected in transit by SSL.

Not sure what your FUD is.

[ Yeah, maybe GCHQ is clever enough to infect xCode and still pass Gatekeeper. But this case shows you don't really have to be that smart -- just tell users "you must click here to run this software" and they'll do it, even if that means disabling security checks. ]

Re:Hard to defend against you say?

[nuonguy]

No Evidence?

Really?

No evidence at all?

What would you consider evidence?

That’s why the news from Bitdefender researchers is so alarming. They discovered sophisticated CAPTCHA-bypassing Android malware in Google Play apps.

from http://www.itbusinessedge.com/...

Re:Hard to defend against you say?

[macs4all]

So that apple can act as a strict gatekeeper to maximise its profitability? What other purpose would it have?

Here we go...

Sigh. Just FOAD, ok?

Re:Hard to defend against you say?

[phayes]

The usual method of getting developers to install a backdoored version of an IDE is to make them think they are downloading the legit one.

Certainly, as long as you are referring to the usual methods of installing backdoored versions of IDEs for Android. As has been repeatedly pointed out, this is NOT how XCode is normally distributed.

Your suppositions of automated and largely useless validation reeks of "this is how Android does it & though I'm ignorant of how Apple does it, I'll still offer baseless conjecture that they use the same methods as Google when authorizing apps". None but the true zealots can doubt that Apple's walled garden has made it much more difficult for malware to spread on iOS versus Android.

The idea that Android is somehow riddled with malware is nonsense. Where are the vast botnets that would exist if it were? The Play store seems to be just as safe as the Apple app store, from a user's perspective.

Android's inability to perform timely updates has prepped it's users for global exploitation. Sufficient weaknesses are well known and the platform has horrendous update propagation so they're not getting fixed. The only thing missing is mistake by a virus author and a worm/virus will propagate like wildfire When it happens it'll make the Morris worm that shut down the Internet look benign.

Re:Hard to defend against you say?

[macs4all]

few developers bother to check file signatures (do Apple even offer them?)

Apple DOES offer hashes/signatures on their regular Downloads; but not for stuff that is distributed through the App Store (which XCode now is).

I ASSUME the rationale is that it is a "closed" file repository/download system; so file signatures were not needed.

I would imagine that may change, or some other verification method post download, will be implemented.

I guarantee that there have already been a few meetings about this. Apple knows how important it is to avoid "poisoned Apples" in the App Store. Especially when that poisoned Apple can make other poisoned Apples.

Re:Hard to defend against you say?

[AmiMoJo]

It seems that one of the affected parties was Tencent, hardly a small developer and unlikely to be using "dodgy" versions of XCode. It very much appears that they have been the victims of the NSA/GCHQ, targeting applications that are popular with Chinese users.

We know that the NSA has the ability to bypass Apple's OS security checks, because they bragged about it in their catalogue of spy tools that was leaked. So it very much appears that they have either found a way around Gatekeeper or managed to steal one of Apple's private keys to sign their malware with.

SSL is no protection, unfortunately, when your opponent can make fake SSL certificates. That's why Google pins its own certs in Chrome, to prevent agencies like the NSA and GCHQ using fake ones signed by hacked/coerced registrars. Again, leaked documents show that this is a tactic they have used in the past.

I'm not singling out Apple here, they attack everyone more or less indiscriminately. We know that they use similar techniques against Windows, Android and Linux operating systems, and against a very long list of companies.

Re:Hard to defend against you say?

[macs4all]

Then what, pray tell, is the point of Apple's byzantine approvals process?

Money.

ORLY?

Apple could make even MORE money by letting ANY software in, and saving the Resources it takes to Approve it.

Therefore, there MUST be another reason. Let's see; what could it be?

Could it POSSIBLY be that they really ARE trying (pretty damned successfully so far!) to keep this kind of shit OUT of the App Store(s)?

Nah. That can't be it. Must be GREED, right?

Haters gotta hate; even when it makes NO sense.

Re:Hard to defend against you say?

[AmiMoJo]

Sorry, you fell for the media hype. From your very first link:

Both Wallpaper Dragon Ball and Finger Hockey, RiskIQ said, have malware that steals confidential information such as device IDs from infected devices.

So an anti-virus company is spreading alarm that apps can access the device's unique ID and the internet, both things the user has to give it permission for. It's bullshit, they are just making out that you need anti-virus software in order to sell their shitty snake-oil product.

By this standard there are thousands of bits of malware on the Apple app store too, because any app that has permission to read the device's ID and internet access is classed as malicious.

The last link you posted is as close as it comes, but requires the user to download an "innocent" looking game that needs permission to send SMS messages (with a big warning that it may COST YOU MONEY $$$). They found one example, and Google removed it quickly. That's a pandemic all right.

Re:Hard to defend against you say?

[sociocapitalist]

Then what, pray tell, is the point of Apple's byzantine approvals process?

Money.

ORLY?

Apple could make even MORE money by letting ANY software in, and saving the Resources it takes to Approve it.

Therefore, there MUST be another reason. Let's see; what could it be?

Could it POSSIBLY be that they really ARE trying (pretty damned successfully so far!) to keep this kind of shit OUT of the App Store(s)?

Nah. That can't be it. Must be GREED, right?

Haters gotta hate; even when it makes NO sense.

Apple would not make more by letting just anything in.

They block whatever competes with Apple themselves.

Re:Hard to defend against you say?

[macs4all]

Then what, pray tell, is the point of Apple's byzantine approvals process?

Money.

Oh, FFS! Stop it!

ORLY?

Apple could make even MORE money by letting ANY software in, and saving the Resources it takes to Approve it.

Therefore, there MUST be another reason. Let's see; what could it be?

Could it POSSIBLY be that they really ARE trying (pretty damned successfully so far!) to keep this kind of shit OUT of the App Store(s)?

Nah. That can't be it. Must be GREED, right?

Haters gotta hate; even when it makes NO sense.

Apple would not make more by letting just anything in.

They block whatever competes with Apple themselves.

Re:Hard to defend against you say?

[Anonymous Coward]

Do you work for Apple or something? Because every time someone says anything that you perceive to be even the smallest of criticism or slights against them, you get all butthurt and start throwing temper tantrums.

Seriously man, they are just a company. Grow the fuck up.

Re:Hard to defend against you say?

[Anonymous Coward]

I can just imagine the spittle flying from your purple face right now.

Re:Hard to defend against you say?

[macs4all]

Do you work for Apple or something? Because every time someone says anything that you perceive to be even the smallest of criticism or slights against them, you get all butthurt and start throwing temper tantrums.

Seriously man, they are just a company. Grow the fuck up.

Google is just a company, and Android is just an OS; but to hear the fandroids on here, you'd think they were both the second coming of Christ.

Re:Hard to defend against you say?

[Anonymous Coward]

Yes, they are just companies. You don't get rabid, foaming at the mouth, responding to every single criticism people popping up when something bad is said about them though. I use an Android phone, but I am also happy to say that Google fucks up quite a lot. I use Windows on my PC and I wouldn't dare say that Microsoft doesn't do scummy shit. I even want Linux to do well and gain more support, but I'm not blind to its problems.

You, quite literally, respond to every single thing that you even perceive as an insult to Apple, even if it's someone stating facts or just their opinion. Objectivity doesn't exist in your little world.

Re:Hard to defend against you say?

[doccus]

In all fairness, we should also get input from Google4all, and Android4all. Not that the name indicates any sort of bias, of course... ;-)

Re: Hard to defend against you say?

[doccus]

Byzantine: As relating to the Byzantine or the Apple Empire: Generally ruled by the Pope.. or other Autocratic leaders, such as Tim Cook:
Conversely:
of, relating to, or having the characteristics of a style of architecture developed in the Byzantine Empire especially in the fifth and sixth centuries featuring the dome carried on pendentives over a square and incrustation with marble veneering and with colored mosaics on grounds of gold.
Take your pick. Personally, I'll go with the "Autocratic leaders like the Pope or Tim Cook", myself....

Re:Hard to defend against you say?

[Anonymous Coward]

Time you were deprogrammed, instructions below.
http://www.theregister.co.uk/2...

Re:Hard to defend against you say?

[Anonymous Coward]

"What's wrong with Apples?"

"They're just not real computers," the PFY says. "They're the piano accordion of the computing world, entertaining, but not made for professionals."

"Our Graphics people..."

"Yeah, but they're not professionals. They'd be just as happy with crayons and finger paints!"

"I... So what happened to your friend?"

"COLLEAGUE!"

"Er, colleague?"

"Who knows?" I say. "He might have run away to join the circus or he might have handed himself in for deprogramming."

"Deprogramming?"

"Yeah," the PFY says. "They strap you into a wheely chair and play In-A-Gadda-Da-Vida at 11 through headphones to you while administering electric shocks - until you renounce your faith."

"And they actually have places that do this sort of thing?"

"Yeah, they're everywhere. All you need is a place where no-one will notice a geek twitching, screaming and occasionally wetting themselves in front of a computer."

"In other words the gaming area of an internet cafe," I say.

"...And this works?"

"Who cares?" the PFY says. "They're filthy Mac users!"

Re: Hard to defend against you say?

[Karlt1]

They block whatever competes with Apple themselves.

There are plenty of apps that compete with everything that Apple sells on the App Store.

Re:Hard to defend against you say?

[phayes]

That sufficient exploits exist in android for the great majority of devices to be victimized cannot be denied. That these exploits can be propagated from phone to phone is also public knowledge. And we all know that there is money to be made by people writing code to exploit thes vulerabilities.

But for you, it's media hype...

Re:Hard to defend against you say?

[AmiMoJo]

That's the fundamental mis-understanding that people have about modern operating systems. They have security systems that mitigate these kinds of problems.

Again, if you think it is that bad, where are the vast botnets, the millions of Euros being fraudulently spent on premium SMS messages etc?

Re:Hard to defend against you say?

[phayes]

If you think that Android isn't a major security train wreck currently and getting worse then I have a few bridges I could let you have -- cheap.

Mitigation has been completely bypasssed. That you think that infection ==> botnets or it doesn't exist and has no consequences merely shows how 1990s your thinking is. Corporate network penetration and stealthy data snooping attacks are already fairly widespread because that is where the money is but given how widespread the weaknesses in Android are known sooner or later a teenager is going to put together a DDOS tool.

Re:Hard to defend against you say?

[KlomDark]

No you...

This is an open source site, not a closed-source proprietary rotten fruit site. Take your drivel elsewhere. Don't need your bullshit here.

Re:Hard to defend against you say?

[macs4all]

No you...

This is an open source site, not a closed-source proprietary rotten fruit site. Take your drivel elsewhere. Don't need your bullshit here.

Really? That's what YOU think it is; but the Masthead says:

News for Nerds. Stuff that matters.

It does NOT say "News for Open Source". Stuff that matters TO YOU.

Re:Hard to defend against you say?

[radish]

Except there is no universal device ID on iOS. Each app sees it's own device ID, so an app which grabbed it and leaked it would benefit no one.

Re:Hard to defend against you say?

[Anonymous Coward]

stupid moron. If android were truly a teeming cesspool of malware, then your internet-killing singularity worm would have already existed, surely.

This shit has got to stop

[AndyKron]

This shit has got to stop. Either programmers have to stop it, which I doubt can be done, or a lifetime in prison for anybody caught doing this shit.

Re: This shit has got to stop

[Anonymous Coward]

Stop what? There were several points to take issue with. I'd rather not see people go to prison for trying to use counterfeit copies of Xcode rather than just use the official copy direct from Apple.

Re:This shit has got to stop

[chill]

Yeah. That's the CIA buddy. Good luck with that.

One of many articles.

Re:This shit has got to stop

[fisted]

a lifetime in prison for anybody caught [writing malware].

You are literally retarded.

Re: This shit has got to stop

[Anonymous Coward]

Xcode is free. Why are people counterfeiting it except for malucious purposes?

Re: This shit has got to stop

[Anonymous Coward]

Suppose that the attackers in this case were state-sponsored. What would you propose then? I suggest that the better solution is to improve the state of software development into something more like traditional engineering, with rigorously understood and controlled failure modes. If it were much harder to inject malware, typical people (as opposed to software developers) would have to worry much less about it.

Re: This shit has got to stop

[Noah Haders]

Suppose that the attackers in this case were state-sponsored. What would you propose then?

WAR!!!!!!!!

Re: This shit has got to stop

[Anonymous Coward]

I think software development does a lot more rigorously engineering than traditional engineering. The biggest issue is that every line of code roughly equals a moving part in traditional engineering. If you show me a machine with a million moving parts, that works in combination with a machine that also has a million moving parts that functions correctly we can talk again.

Re: This shit has got to stop

[Anonymous Coward]

It's so commonplace in China people don't even reflect on when something is free.

Re:This shit has got to stop

[gweihir]

Repression will do exactly nothing. Remember that all crime is already illegal.

The easy solution would be for the coders to verify the package-signature each time they download a tool. It does require some minimal understanding of security (which most coders do not have) and the presence of said signatures. It has been done with PGP-signatures for security-critical FOSS software like the Linux Kernel, GnuPG, etc. for decades and is quite successful at preventing these attacks.

Vetting of apps?

[Rainbow Nerds]

I'm wondering how these apps made it through in the first place. Apple is known for being strict about vetting apps and what's allowed to enter the walled garden. If so many apps were able to make it past the vetting, it ought to raise concerns about what other malicious apps might be in the app store on a smaller scale. The vetting process probably lulls many users into a false sense of security that any app downloaded is going to be safe because Apple wouldn't let unsafe apps through. Obviously that's not the case, and it's not possible to know before downloading an app whether it's safe or not. Even reputable publishers could be compromised in this way. Although I think the walled garden is actually a good idea, it's obviously not sufficient, and there needs to be other layers of security. As much as I despise most antivirus software, it might be another good line of defense. I'd like to see more about app permissions like the old Android Market listing, and perhaps firewalling and only whitelisting certain sites for apps to connect to. It's reasonable that the browser you download would be able to connect to any site; that game, not so much. What's there now isn't enough and there really is no way for a user to know that an application is safe prior to installing it.

Re:Vetting of apps?

[tepples]

I'd like to see more about app permissions like the old Android Market listing

The permissions are still listed. Crossy Road , the endless Frogger-clone that's become popular on Google Play. Scroll down to "Permissions" and click "View details". Or are you asking for some sort of rich privacy policy where each permission is justified with an immediately adjacent rationale, such as "Uses camera to scan barcodes" or "Uses phone state to pause gracefully when a phone call is received"?

and only whitelisting certain sites for apps to connect to

I don't see how this can be effective, as the app may use one of those whitelisted "certain sites" as a proxy.

Re:Vetting of apps?

[brantondaveperson]

When presented with a request for access to a local or remote resource generated by a running application, almost everyone clicks "Yes".

They normally click "Yes" without even reading the prompt, and certainly without conducting a thorough review of what the application is attempting to access, and why. This is because people are not on the whole security professionals, and just want to get shit done on their phones (or tablets, or PCs, or whatever).

Permissions are not a solution to this problem.

Re:Vetting of apps?

[sims 2]

Java trains people to click yes.

Re:Vetting of apps?

[ewibble]

The user should be able to lie and say yes, but actually not grant access,

Want access to my contacts sure, here is my fake contacts.
Want access to my phone calls sure, but it will look like I make none.
Want microphone access sure here is some random noise. ...

The problem with forcing a yes/no answer if you answer no you can't run the app, that means people will generally just say yes.

Re:Vetting of apps?

[Dog-Cow]

That's only true on Android, and only until Marshmallow. On iOS, if the app refuses to work without permissions, the app will be rejected (if Apple catches it). I suspect that Apple would similarly reject updates if customers complain about the app. And if Apple does allow the app through, customers will reject it when they find out it requires permissions it doesn't need for its primary functionality. No one would expect a video chat app to work w/o video and mic, for example.

Re:Vetting of apps?

[Anonymous Coward]

The only permissions system I've found that works is Protect My Privacy (on JB-ed iOS systems), or xPrivacy on Android. Both allow apps to have whatever permissions they want... but fake the results. That way, an app which requires you to allow it to post notifications (FB Messenger), or an app that requires locations (Yik Yak) will always receive relevant data... but data you choose to feed it.

Everything else is just crap. Even an average fleshlight app on either the Play Store or Apple's store connects to a shitload of ad sites in the background.

Re:Vetting of apps?

[Anonymous Coward]

LMFAO you're funny.

People actually using their brain? Nobody will reject apps because of permission abuse - especially with the stupidly-restrictively-simple-because-idiot-users i-things - they'll just click yes because they believe it "just works".

Only a handful of comments and users care about Android permissions - even less percentage will care about abuse on ithings.

Re:Vetting of apps?

[PhunkySchtuff]

I'm wondering how these apps made it through in the first place.

From what I've read - it was a trojaned version of Xcode that some developers have used and this has inserted malware into their otherwise apps.
Apple's scanning has now discovered it, although I don't know why it has taken them so long to pick it up.

Re: Vetting of apps?

[Buck Feta]

average fleshlight app

Good ol' phone sex...

Re:Vetting of apps?

[Noah Haders]

*flashlight

Re: Vetting of apps?

[Anonymous Coward]

The simplest of checks, say a verification at apples end, that the app asking for publish approval was developed with a signed and verified version of ide Xcode would have prevented this. Seems like apples "extensive vetting process" isn't as robust as they would have us believe...

Re:Vetting of apps?

[Anonymous Coward]

Of course people click "Yes" since it is the only way to install what they want. If clicking "No" allowed the app to be installed and work, but with limited functionality, then more people would actually deny flashlight apps access to location data or contacts.

Re:Vetting of apps?

[Anonymous Coward]

Anyone who has installed Java have been trained to know that really bad things can happen if you click yes too many times without unchecking boxes.

Re:Vetting of apps?

[Anonymous Coward]

Permissions can help the person vetting the application for the app store. They can take a minute to think about what permissions the application should require, then reject the application if it requests anything else.

Re:Vetting of apps?

[drinkypoo]

I'm wondering how these apps made it through in the first place. Apple is known for being strict about vetting apps and what's allowed to enter the walled garden.

Apple is known for mysteriously and capriciously denying apps which are similar to other apps which they have accepted. Nobody knows on what basis they justify their decisions, because they don't have to justify their decisions. How that's even legal when they have a monopoly over software distribution to untampered devices... well, money. That's how.

Although I think the walled garden is actually a good idea

It isn't.

Re:Vetting of apps?

[Lennie]

No, fake contacts doesn't solve the problem. The problem is you need a better model is. Funny fact Android already has one:

http://developer.android.com/r...

A similar model was adopted by FirefoxOS from the start:
"Web Activities are a way to extend the functionality of HTML5 apps without having to access the hardware on behalf of the user. In other words, you don’t need to ask the user to access the camera or the phone, but instead your app asks for an image or initiate a call and the user then picks the app most appropriate for the task. In the case of a photo the user might pick it from the gallery, the wallpapers or shoot a new photo with the camera app. You then get the photo back as a file blob. The code is incredibly simple:"

https://hacks.mozilla.org/2013...

It's a form of the https://en.wikipedia.org/wiki/...

Re:Vetting of apps?

[gweihir]

People vastly overestimate what Apple can do. Basically, reviewing an app for backdoors competently takes several times as much effort as writing it, and the people doing the review need to be significantly better than the original coder. It is a lot cheaper in practice to just re-implement with trusted people.

Re:Vetting of apps?

[angel'o'sphere]

What has Java (or any programming language) to do with that?

When I use Java there is no random Dialog popping upo asking me to click yes for anything ... why should there?

Re:Vetting of apps?

[angel'o'sphere]

The problem with forcing a yes/no answer if you answer no you can't run the app, that means people will generally just say yes.

That is complete nonsense!
The app does not really know if you have clicked yes or no, the Operation System is asking you, not the app. And an app like "Viber" or "WhatsApp" accessing your Location, just works fine when iOS askes: "may this app access your Location" and you answer: "no".
Why the funk should the app stop working?

Re:Vetting of apps?

[jittles]

I'm wondering how these apps made it through in the first place. Apple is known for being strict about vetting apps and what's allowed to enter the walled garden. If so many apps were able to make it past the vetting, it ought to raise concerns about what other malicious apps might be in the app store on a smaller scale. The vetting process probably lulls many users into a false sense of security that any app downloaded is going to be safe because Apple wouldn't let unsafe apps through. Obviously that's not the case, and it's not possible to know before downloading an app whether it's safe or not. Even reputable publishers could be compromised in this way. Although I think the walled garden is actually a good idea, it's obviously not sufficient, and there needs to be other layers of security. As much as I despise most antivirus software, it might be another good line of defense. I'd like to see more about app permissions like the old Android Market listing, and perhaps firewalling and only whitelisting certain sites for apps to connect to. It's reasonable that the browser you download would be able to connect to any site; that game, not so much. What's there now isn't enough and there really is no way for a user to know that an application is safe prior to installing it.

they run a static analyzer on app submissions that check for when a developer makes private API calls. It doesn't catch everything. I've worked on a white label app that had 280 successful reviews in the app store and randomly was rejected on 281st submission because I forgot to enable a new permission for the app prior to submission. My permissions files were all generated using a template so all apps were missing that permission. The users were still prompted to grant permissions. Apple generally doesn't let you enable permissions on functionality that you do not actually need for your app to function. If you used some Objective-C trickery to make hide private API calls it is quite possible that Apple will not even detect it unless that call is, perhaps, triggered during the app review process.

Re:Vetting of apps?

[sims 2]

Java autoupdate aka jucheck.exe.

http://forums.whirlpool.net.au...
Here is one example for more just google "java uac"

Without disabling uac or uninstalling java the only way I am aware of to fix it is to disable java's automatic updates which sounds like bad security practice but afaik no other fixes are available.

Re:Vetting of apps?

[Anonymous Coward]

>I'm wondering how these apps made it through in the first place.

I'm sure the malware didn't display a popup saying, "This is malware." The review process is just a layer. The real value is the ability of Apple to nuke malware from orbit on all phones fairly quickly.

Re:Vetting of apps?

[jo_ham]

Of course Apple have a monopoly on their own products... I'm not sure how you can't see that this is obviously legal.

There's no legal problem with being the only store on a product that you sell, *especially* when Android makes up the bulk of the smartphone market.

So, "how that can even be legal" is that Apple are not a monopoly as far as smartphones are concerned, nor are they leveraging their non-monopoly position in one area to promote their business in another.

Re:Vetting of apps?

[BasilBrush]

People automatically click yes when they perceive their is no alternative. If you get a dialog that says "Yes"/"Cancel", then they'll click yes, because they do actually want the action that they asked for performed.

Likewise with classic Android permissions, refusing permission meant you couldn't install the app. So people were trained to accept them regardless.

With iOS requests for permission at the time of first use of a resource, the question is a significant one, Both Yes and No still allow the app to continue, to the extent that it's possible to without the resource being requested. For example a maps app will still function if you reply no to a location request. It just won't centre the map where you are.

Re:Vetting of apps?

[BasilBrush]

How that's even legal when they have a monopoly over software distribution to untampered devices... well, money.

For the umpteenth time, a company's own platform is not a market for the purposes of competition laws.

Although I think the walled garden is actually a good idea
It isn't.

You don't even use the platform. The walled garden is an extremely attractive security and ease of use feature of iOS. Regardless of what Android fans say.

Re: Vetting of apps?

[Anonymous Coward]

How so? They caught this malware dead in its tracks.

Re:Vetting of apps?

[Anonymous Coward]

Do you know how fucking stupid you sound when you immediately disregard everyone using an Apple device as stupid?

Plenty of really smart people carry an iPhone because they just don't want to fight with their phone, or deal with Google's bullshit. Or maybe they bought into iPhone when Android was a fucking disaster, and have been happy with the platform since.

Estimating someone's intelligence based on what phone they have in their pocket makes it quite easy to estimate yours.

Re:Vetting of apps?

[MachineShedFred]

More than that, it's spelled out explicitly in Apple's app developer guidelines that the app will be rejected if it doesn't gracefully handle a permission denial. And, that would be incredibly easy to test in an automated fashion.

Now if the developer is a dick and just disables all the apps functionality because you don't give them permission to your contacts, then shame on them and they deserve a nice dose of herpes. But again, it's up to the user to have some responsibility in protecting their information, and they shouldn't just blindly allow permission to anything that asks.

Re:Vetting of apps?

[MachineShedFred]

Don't know what platform you're using, but it's completely possible (and required for App Store acceptance) on iOS.

Re:Vetting of apps?

[Anonymous Coward]

Yeah, how is it even legal to only be able to buy genuine Mercedes parts from Mercedes dealerships? Government should step in and protect us from having to buy parts from the OEM!

Are you an idiot?

Re:Vetting of apps?

[mlts]

The problem is that on Marshmallow, the dev has to have a manifest allowing for the switched permissions to happen included with the APK file, otherwise, it will default to its traditional all or nothing.

As mentioned elsewhere, I will plug xPrivacy. If an app wants everything under the sun, it can have it. The camera will happily give black frames, the app can slurp all the video from /dev/null it can handle, the user is always located in the same spot, and the IMEI/UDID is always different each time it is asked.

On iOS, I recommend PMP, but that requires a jailbreak.

Re:Vetting of apps?

[Anonymous Coward]

Anyone installing Java should Ask.com themselves "did I uncheck the necessary checkboxes?"

Re: Vetting of apps?

[macs4all]

The simplest of checks, say a verification at apples end, that the app asking for publish approval was developed with a signed and verified version of ide Xcode would have prevented this. Seems like apples "extensive vetting process" isn't as robust as they would have us believe...

No.

It seems like Apple didn't expect anyone to get the FREE XCode from any other source but them.

Many vulnerabilities are discovered in exactly this sort of way. But rest assured, if the fix isn't already in place, it will be quite soon.

Re:Vetting of apps?

[macs4all]

People vastly overestimate what Apple can do. Basically, reviewing an app for backdoors competently takes several times as much effort as writing it, and the people doing the review need to be significantly better than the original coder. It is a lot cheaper in practice to just re-implement with trusted people.

Exactly!

If even a modicum of obsfucation is used, a skilled Developer can hide quite a bit in a system as huge as XCode. And I don't think AI is to the point where it can "out intuit" humans.

Re:Vetting of apps?

[Anonymous Coward]

> There's no legal problem with being the only store on a product that you sell,

Then why does everybody complain about Google listing their services first on search results?

Re:Vetting of apps?

[phantomfive]

I'm wondering how these apps made it through in the first place. Apple is known for being strict about vetting apps and what's allowed to enter the walled garden.

The vetting process is strict and sometimes capricious, but do not be deceived that is by any means thorough.

Re:Vetting of apps?

[narcc]

But you are one of the people who "vastly overestimate what Apple can do".

Look at the posts you've made here. You'd think your whole world view was crumbling around you.

Just accept the fact that Apple isn't infallible, the walled garden is no guarantee against malware, and people will criticize them when their draconian policies fail to deliver on the promises they've made in exchange for your acceptance of the same.

You're getting better. Just look at this amazing quote:

If even a modicum of obsfucation is used, a skilled Developer can hide quite a bit in a system as huge as XCode.

Had someone else made the same statement earlier, you'd have fallen over yourself in a vain attempt to defend Apple against this "fud".

Re:Vetting of apps?

[macs4all]

Just accept the fact that Apple isn't infallible, the walled garden is no guarantee against malware

Of course Apple isn't infallible; duh!

And although a Curated Collection is no guarantee against malware, it is a very good step in the right direction. Witness the fact that Google Play started out as the Wild West, and gradually became more and more "walled" (yes, you can still "sideload" apps; but it is becoming more and more discouraged by Google). And I believe the MS "App Store", and their mobile OS is also "Curated Only", just like Apple.

Re:Vetting of apps?

[drinkypoo]

You don't even use the platform.

Guess why?

The walled garden is an extremely attractive security and ease of use feature of iOS.

It does none of the things you claim it does, and it does several negative things.

Regardless of what Android fans say.

If you're ignoring what people say because of the platform they're using, you're the fanboy.

Re:Vetting of apps?

[BasilBrush]

Guess why?

Because you have no taste. Or possibly you can't afford it.

Re:Vetting of apps?

[Anonymous Coward]

Is this the CHINA STORE ? Because the initial release of information was about infected apps on the chinese app store.
That suggests Chinese developers using hacked/cracked/malware infested boxes to package their apps.

Re:Vetting of apps?

[R3d M3rcury]

So, "how that can even be legal" is that Apple are not a monopoly as far as smartphones are concerned, nor are they leveraging their non-monopoly position in one area to promote their business in another.

True, but remember that there are other people who will decide what "the market" is.

Way back when, Microsoft claimed they did not have a monopoly in the personal computer market because of Apple. They grabbed all of the Apple statistics to show this. Of course, the government said, "Yes, that's very nice. But you do have a monopoly on Intel-based personal computers."

Oh, and by the way, iTunes could easily be considered a monopoly (Apple loves to crow about it's market share) and it could be argued that Apple is under-cutting it's competition in the streaming music market.

Re:Vetting of apps?

[perpenso]

Apple is known for mysteriously and capriciously denying apps which are similar to other apps which they have accepted.

Other than fart and flashlight type apps?

Re:Vetting of apps?

[Anonymous Coward]

Because you have no taste. Or possibly you can't afford it.

And this is the mindset of your average Apple user.

Re:Vetting of apps?

[angel'o'sphere]

So this a general problem, as I pointed out, and nothing specific to Java.

Re:Vetting of apps?

[sims 2]

Does java really need to run as administrator to check if an update might be available? That part is wholly and entirely java's fault. Other software only requires uac prompt when making changes such as update,install or uninstall not checking.

With air,flash,shockwave,adobe reader,silverlight and java 8 installed the only one to nag to check for updates with a uac prompt is java.

Then it tries to trick you into installing the ask toolbar after you allow it to run if it finds an update available.

Annnd back to thread topic.

Asking a user that doesn't know or doesn't care Is not typically beneficial. It's even worse in a business environment Is xyz.exe supposed to be running? Is it malware? Or did some lazy programmer name their background database manager xyz.exe to save time? support is only by about once a month so risk breaking something? or allow all?

Allow all and let someone else worry about it is pretty much always the eventual conclusion.

Ill even quote just for fun.
"Permissions are not a solution to this problem"

Re:Vetting of apps?

[warm_warmer]

Yep, plus Windows Vista/7 UAC, and pop-over ads that require people to click "x" before being able to read content on the screen...

Come to think of it, clicking past warnings and pop-ups is actually quite pervasive.

Re:Vetting of apps?

[angel'o'sphere]

Java is very likely not running as administrator, but the "Java Updater Program" might be.

Updating has nothing to do with the original claim of the parent that "Java would train users to automatically click yes".

From your posts I conclude you run windows ... well, I pitty you.

Re:Vetting of apps?

[sims 2]

Yeah I was off on the original claim,
The update checker is quite Naggy but doesn't teach much other than "oh it does that every time I start my computer"

And thank you windows is not near as fun as it sounds.
Keeps me busy though one problem after another.

Anyone figured out how to retrieve data from corrupted whs backups yet? No? Darn.

Re:Vetting of apps?

[Anonymous Coward]

Don't pity those who know how to use windows properly. Pity the millions of idiots that "just click the icon" to "get to the google". Those are the ones that click "yes" or "ok" whenever prompted.

Ironically this was caused by slow XCode downloads

[Anonymous Coward]

Some Chinese developers downloaded this tainted XCode because of slow download times of XCode from the Mac App Store.

Downloading XCode from the Mac App Store takes nearly a full day!
 
I think this delivery mechanism of XCode is developers is very crummy and quite a nuisance.

And that's why you don't trust apps initially

[SuperKendall]

This kind of possible attack is mitigated because after you download an app, it still has no permissions to do anything interesting - access to background location, contacts, camera, audio, etc. all require permissions that prompt the user for access.

So even if someone uses an Xcode that is compromised, there's not very much gain you are going to get by having malicious code in the app except for what that app is working with.

Happily Android has also recently moved to this same "permission on demand" model which makes way more sense than "agree to laundry list of demands to run" ever did.

On a side note, I would think it would be hard for an attack like this to succeed because as a developer builds an app, they are often monitoring network traffic or otherwise examining app activity... even in release mode at times.

Re:And that's why you don't trust apps initially

[FranTaylor]

So even if someone uses an Xcode that is compromised, there's not very much gain you are going to get by having malicious code in the app except for what that app is working with.

how about adding an extra hidden recipient to all your emails? there's no way any security system is going to stop that.

how about a bank app that transfers money to the malware author instead of the intended recipient? again how do you stop that with security?

Re:And that's why you don't trust apps initially

[Anonymous Coward]

Yea, developers don't do that unless they have a reason to believe something is wrong.

Re:And that's why you don't trust apps initially

[nine-times]

how about adding an extra hidden recipient to all your emails? there's no way any security system is going to stop that.

How easy is that to do for someone other than the developer of the mail app? My understanding is that the apps are sandboxed in a way that wouldn't allow an easy route to alter how other apps worked.

Re:And that's why you don't trust apps initially

[FranTaylor]

because as a developer builds an app, they are often monitoring network traffic or otherwise examining app activity

if (strcmp(username, "suckerDeveloper")) {
    do_nasty_stuff();
}

the app won't do anything differently when it's running on the developer's computer

Re:And that's why you don't trust apps initially

[FranTaylor]

How easy is that to do for someone other than the developer of the mail app?

what if the developer IS developing a mail app?

Re:And that's why you don't trust apps initially

[SuperKendall]

And the person developing the cracked version of Xcode knows my development username how again? Or any of the accounts I use for testing?

Re:And that's why you don't trust apps initially

[windwalkr]

This kind of possible attack is mitigated because after you download an app, it still has no permissions to do anything interesting - access to background location, contacts, camera, audio, etc. all require permissions that prompt the user for access.

So even if someone uses an Xcode that is compromised, there's not very much gain you are going to get by having malicious code in the app except for what that app is working with.

Unless they can trick the user into giving up their iTunes account details by showing a system-prompt-lookalike. The system already prompts for passwords at some pretty random times, so that might not be hard.

Or they could customise the exploit behaviour depending on the host application. Wait until some relevant app has been successfully exploited and is reporting in, then tailor an approach to steal whatever app-specific data is relevant (login details, etc) or even override the app's networking classes and MITM the outgoing connections.

On a side note, I would think it would be hard for an attack like this to succeed because as a developer builds an app, they are often monitoring network traffic or otherwise examining app activity... even in release mode at times.

Even if this were true (I don't really agree that it is, although I do agree that somebody will spot it sooner or later) then it would be easy enough to work around. Just have the exploit not phone home until after a certain fixed date, or a certain amount of time after the app was built, or not while a debugger is attached, or etc. In fact, since you've compromised the Xcode tools, just hide any reporting of your exploit's activity.

Just because you can't necessarily gain control over the whole device this way (it's one step towards that, but you'd need a secondary exploit) doesn't mean that it isn't a problem.

Re:And that's why you don't trust apps initially

[Anonymous Coward]

if(today()-installDate()>SUCKERS_INITIAL_TRUST_THRESHOLD_TIME) {
      doHack();
}

Re:And that's why you don't trust apps initially

[SuperKendall]

I never said it was not a problem; just that it's very difficult to get an exploit through all of the layers it needs to go through to get to the app store...

And as I said in a different response - it seems like all this is a lot more work to go through rather than simply attacking the API server you are communication with.

Re:And that's why you don't trust apps initially

[Dog-Cow]

What about it? This is a tainted copy of Xcode that can't be doing anything more than including some malware classes in binaries. Probably uses the ObjC +load method to kickstart itself when the app starts. There's no way for the tainted code to have a clue as to what the app does, and thus no way to "add another email address" or "redirect bank transfers".

Computers aren't magic.

Re: And that's why you don't trust apps initially

[Anonymous Coward]

Because the developer is running a tainted app. It could send screenshots and other information to the malware dev and they customize based on the developers value.

Re:And that's why you don't trust apps initially

[windwalkr]

I would have said that getting Xcode exploited in the wild was the tricky bit. Most of the rest of it seems pretty trivial.

Attacking the API server is certainly an option, but you'd need a separate exploit for that, plus you're working in an area where an exploit attempt is expected and hopefully being monitored for. So far, this kind of attack has been pretty much under the radar, at least on iOS. Maybe that will change now.

Apple can obviously check for the signature of this specific exploit easily enough, but it will be interesting to see whether they have a quick answer to the general problem.

Re:And that's why you don't trust apps initially

[0123456]

Happily Android has also recently moved to this same "permission on demand" model which makes way more sense than "agree to laundry list of demands to run" ever did.

If, by 'recently', you mean 'in a still unreleased version of the OS that most current Android users will never get.'

It will be years before the majority of Android users have that capability, which should have been in the OS from the start.

Re:And that's why you don't trust apps initially

[SuperKendall]

I would have said that getting Xcode exploited in the wild was the tricky bit. Most of the rest of it seems pretty trivial.

None of it is trivial given the moving target that is Xcode, and all the possible ways an app might be developed and Xcode project settings changed, not to mention the mixture of Swift and ObjC...

Remember that in the course of an application development it's likely there will be at least one Xcode update, which you also have to infect in the same way before they download it...

Attacking the API server is certainly an option, but you'd need a separate exploit for that, plus you're working in an area where an exploit attempt is expected

That doesn't prevent servers from being exploited all the time, plus often the attack comes from some other internal system that has been compromised - not externally. Which is a far easier route to maintain than constantly hacking Xcode versions.

it will be interesting to see whether they have a quick answer to the general problem.

Do they really need one beyond "download Xcode updates from Apple"? All of the developers compromised were downloading Xcode from a mirror in China, which you can pretty much expect to be exploited in some way.

Here's a good example of how even developers can be careless with security though: when you download Xcode and drag it into applications, on first run it scans to make sure the binary matches a CRC. Well that takes a while, so some time ago I saw a post from a developer showing how to mark the application binary as already scanned so you would not have to wait... hopefully people have stopped doing that at least!

Re:And that's why you don't trust apps initially

[friedmud]

In this case the malware was reporting back to a server with lots of details about where it was running... including what app it was buried inside of and then awaited further instruction.

It's definitely conceivable that the authors would send back specific instructions for what to do _in that particular app_... like steal bank account numbers or mess with email...

Re: And that's why you don't trust apps initially

[Anonymous Coward]

If date >> build-date do-nasty-stuff()

Re:And that's why you don't trust apps initially

[windwalkr]

None of it is trivial given the moving target that is Xcode, and all the possible ways an app might be developed and Xcode project settings changed, not to mention the mixture of Swift and ObjC...

Remember that in the course of an application development it's likely there will be at least one Xcode update, which you also have to infect in the same way before they download it...

Yeah, that's exactly what I mean. That's somewhat hard, and yet they've still succeeded. I guess there are enough people using this approach that some were stung, even though others were not for the very reasons you state.

Do they really need one beyond "download Xcode updates from Apple"?

Apparently so? :)

Will be interesting to see if this problem recurs, either directly or in some secondary manner (eg. an exploit for the dev machine which modifies Xcode and disables gatekeeper, or whatever.)

Re: And that's why you don't trust apps initially

[Anonymous Coward]

LOL. I hope you don't really program.

Re:And that's why you don't trust apps initially

[AK Marc]

The solution to this is to have all phones (iPhones and Androids) offer "Accept", "Deny" and "Lie" permissions. Per permission, allow all three. Currently, the setup is you accept or deny the app, but have no choice for permissions. The change should be that you can deny a permission. Deny "contacts" to a game that should never need them, and the game makers will decide whether they'll install with any permissions denied. There should be a difference between "asked for" and "required". And, in either case, allow "lie" as an answer. A contacts list that's blank (or randomized fakes). I can do most of this on Android without too much trouble, but some is harder than others, and none of it is available on iOS. Let me accept a permissions demanding app (that I probably shouldn't be running), then sandbox it with fakes for all the invasive permissions it demands.

Re:Duh

[printman]

Um, Xcode is free.

The only thing you pay for is the $99 to distribute applications (through the App Stores or within your organization) - writing and installing your own applications to your iPhone, iPad, Apple Watch, Mac, etc. are all free.

The issue here appears to be limited to developers that are downloading Xcode from unofficial sources which allows their code to become infected.

People are Stupid, exhibit 49284a

[Dutch Gun]

From the article:

The tainted version of Xcode was downloaded from a server in China that developers may have used because it allowed for faster downloads than using Apple's U.S. servers, Olson said.

Really? Really?!?

From the context in the article, it obviously sounds like these were Chinese developers. You click on the Apple app store, and Xcode downloads for free. I'm not sure how it could be easier - if speed was the issue, just update overnight. I can't figure out what the exact angle is, but it just seems too strange for legitimate developers to "innocently" make such a boneheaded mistake.

Or, maybe Chinese developers are so used to just downloading everything illegally that they didn't think twice about this.

Re:People are Stupid, exhibit 49284a

[technomom]

A little bit of the former, a little bit of the latter I think.

XCode takes forever to download in China and people are used to downloading black market software.

Re:People are Stupid, exhibit 49284a

[nine-times]

I can't figure out what the exact angle is, but it just seems too strange for legitimate developers to "innocently" make such a boneheaded mistake.

I'm just throwing it out there, but could it be something like: The developer thought he'd be clever by downloading a pirated/hacked version of OS X that runs on non-Apple hardware. The hacked version either then downloads a hacked version of Xcode, or won't allow a legit installation of Xcode so that the developer is forced to pirate that, too.

I don't know, just I'm hypothesizing. If it's not something like that, then I have a hard time figuring out how an iOS developer could unintentionally install a fake version. Unless... I don't know, maybe someone rigged Chinese search engines so that when you search for "Xcode", the top hits point to illegitimate sources?

Re:People are Stupid, exhibit 49284a

[lucm]

XCode takes forever to download in China

XCode, and everything Apple, takes forever to download everywhere. It's faster to download the CentOS "Everything ISO" (7GB) from a shitty ftp mirror in Egypt than to get XCode (3GB) from the global network of the wealthiest company in the world.

Wtf Apple.

Re:People are Stupid, exhibit 49284a

[Anonymous Coward]

I'm just throwing it out there, but could it be something like: The developer thought he'd be clever by downloading a pirated/hacked version of OS X that runs on non-Apple hardware.

More likely, they thought they were downloading from an (unofficial) *mirror* that meant their connection didn't have to cross the Pacific Ocean, or traverse the Great Firewall of China. Downloading from a local source is *often* much faster, simply because it traverses fewer of the often saturated international, or intercontinental connections.

Re:People are Stupid, exhibit 49284a

[Anonymous Coward]

Or consider this nasty little trick: the Chinese government (or certain TLA agencies) watches for XCode downloads, and since they can mitm the entire country, simply switch the developer's coffee with Folger crystals. Developer is none the wiser, Apple is none the wiser, and the Chinese (or TLA Agency) let the developers create and sell their apps. Which have backdoors.

When your tools get corrupted without your knowledge you're well and truly screwed.

Re:People are Stupid, exhibit 49284a

[Anonymous Coward]

It's simple enough to get OS X running on non-Apple hardware; no need to do that...the official XCode runs just fine on a MacHack.

Re: People are Stupid, exhibit 49284a

[Anonymous Coward]

It's a control thing. And the suckers always fall for it.

Re:People are Stupid, exhibit 49284a

[Anonymous Coward]

Might have something to do with your ISP and their connections. As long as it isn't on a major software release day we can get things extremely quickly from Apple on a university connection. However, downloading from my cable vendor was terrible until I used a VPN connection back to the university, then it was much faster again.

If you're in the US I suspect your connection to Apple will get much better now that they have a few net neutrality rules to follow...

Re:People are Stupid, exhibit 49284a

[Anonymous Coward]

I guess when you are the only person downloading anything it comes down much faster ;-)

Personally I find downloading stuff like Xcode is much faster on my home VDSL connection than our Universities connection.

Re: People are Stupid, exhibit 49284a

[Anonymous Coward]

Uhm, no. You just have a terrible ISP.

Re:People are Stupid, exhibit 49284a

[friedmud]

Yep - this is what happened. In particular, they were downloading from Baidu... which was much faster than downloading from Apple directly.

Re:People are Stupid, exhibit 49284a

[angel'o'sphere]

I live in Germany ... when I download XCode it rarely takes longer than 20 - 30 minutes.

Your problem is most likely your shitty Internet in your country and not Apple. Ask your ISP what is going wrong.

Re:People are Stupid, exhibit 49284a

[Anonymous Coward]

Anyone else based in China want to add to this? Is it true that Apple's largest market outside of the United States does not have a nearby CDN for the App Store?

all Zombie Movies start this way

[turkeydance]

Apple's no difference.

Re:Duh

[Anonymous Coward]

They aren't paywalled.

You can download Xcode for free, and you can install apps you build on your own devices with the same Apple ID

You only pay if you want to distribute the binary to Apple's App Store, or you want to distribute with an Enterprise Developer certificate.

Re:Duh

[Anonymous Coward]

More like, this is exactly why development tools should be paywalled. It may suck to have to vnc into an apple.com-hosted development machine but at least it would close this vector of fake tools.

Re:Free as in $5 to $15 per GB?

[Anonymous Coward]

> urban Seattle, multiple gigabytes can become very expensive to download.

This! We're still updating a dozen dev machines to XCode 6.4 for iOS 9 support. It looks like it is going to take two weeks since we're in Seattle and stuck sharing an ISDN line between almost twenty people. I wish Apple had a solution where you could download the update once then redistribute it.

Re:Duh

[bloodhawk]

They aren't. But even if they were why the fuck would this make a difference in this situation?

Re:Free as in $5 to $15 per GB?

[Anonymous Coward]

By that particular definition of 'paywalled', literally *everything* is 'paywalled' for those users, including the official Linux kernel source tree.
If your definition includes *literally* everything that can be downloaded, it probably isn't a useful (or accurate) definition of a paywall.

Re: Free as in $5 to $15 per GB?

[Anonymous Coward]

It's actually version 7.0, and is a 3.59 GB update. With our office dialup at 26k bps, it looks like it is going to take us 17 days per Mac dev system. Seattle sucks.

Re: Free as in $5 to $15 per GB?

[Anonymous Coward]

Wow, weeks. We usually take our systems to N employees house that lives outside of Seattle and has Frontier to update them. It's a huge time waster. It's sad that the city government is so anti-Internet.

Re: Free as in $5 to $15 per GB?

[Anonymous Coward]

I'm the GP. You're right, it is 7.0 The system I checked on wasn't updated, but I thought it was. So, that's one more update that's going to take 3.5 more days to download the upgrade.

Free as in allowing sneakernet use

[tepples]

Linux source code can legally be downloaded once per neighborhood and sneakernetted from one machine to another. Xcode, being proprietary software, doesn't allow this.

Re:Free as in allowing sneakernet use

[Anonymous Coward]

Pretty sure you can move Xcode from machine to machine. These developers were downloading the code from an alternate because it offered faster bandwidth than the Apple China servers. Basically, crappy developers taking shortcuts and paying the price for it.

Re:Free as in allowing sneakernet use

[dgatwood]

Of course it does. Download the DMG, and copy the DMG to a dozen machines before you agree to the license. :-D

But in all seriousness, if there's no practical difference between downloading it 17 times and downloading it once and installing it 17 times, then the law would almost invariably consider them equivalent. And Apple doesn't forbid you from downloading it 17 times and installing each copy to a new machine, so you should be in the clear even if Apple were insane enough to try to sue you for doing it. And of course, there's no way Apple would ever be crazy enough to do that, making the whole point moot (in both the American and British sense).

Re:Free as in allowing sneakernet use

[Dog-Cow]

You are a fucking idiot and a complete asshole. Please put yourself out of your misery by strangling yourself with a lightning (tm) cable.

Re:Free as in allowing sneakernet use

[jo_ham]

Linux source code can legally be downloaded once per neighborhood and sneakernetted from one machine to another. Xcode, being proprietary software, doesn't allow this.

Where's the "-5 hilariously wrong" mod?

I think you just demonstrated that your dislike of a company is strong enough that you don't mind lying to spread FUD.

Re:Free as in allowing sneakernet use

[tepples]

Where's the "-5 hilariously wrong" mod?

I think it unlocks for other moderators once someone posts a citation that disproves a claim made in a given post.

Re:Free as in allowing sneakernet use

[MachineShedFred]

You're completely full of shit. Download XCode from the app store, and then copy / redistribute to any and all Macs in the office without any issue.

I know that drag-and-drop is hard, but you'll get the hang of it someday.

Re:Free as in allowing sneakernet use

[tepples]

Thank you for clarifying that it's possible technically. I wasn't sure whether it was also allowed legally.

Re:Free as in allowing sneakernet use

[macs4all]

Linux source code can legally be downloaded once per neighborhood and sneakernetted from one machine to another. Xcode, being proprietary software, doesn't allow this.

Idiot.

XCode could care LESS where the .pkg or .dmg file it resides on came from. You can download it once, and LEGALLY (and easily) stick it on a network drive, ftp server, USB stick, portable hard/ssd drive, and install it on as many Macs as you care to.

Just because something isn't Open Sores, doesn't mean that it's DRMed.

Stupid fuck.

Re: Free as in $5 to $15 per GB?

[brantondaveperson]

Sign into https://developer.apple.com/do..., and click here

You know what they say...

[Anonymous Coward]

App appers who app apps get apped!

Apps!

Re:You know what they say...

[Anonymous Coward]

No Moo today?

How would you do that exactly?

[SuperKendall]

how about adding an extra hidden recipient to all your emails?

How would you do that?

The MFMailComposer class window you open tokenizes email recipients for the user, I can't see any way of composing an email that you could not see it was going to more than one person, or that you had pre-populated the "to" or "cc" or "bcc" values with an address they did not know.

You have no control or visibility as to email addresses the user populates in this composer window. The content is totally separated from the other email fields.

The app has no control of what happens when you press send; you cannot inject post-send hooks. The mail server communication does not occur in the same application process.

how about a bank app that transfers money to the malware author instead of the intended recipient?

That's a more realistic scenario for risk I imagine. But also much harder to get through the extensive testing any serious app has; you would see funds were not being transferred to the right account. Also pretty sure any decent banking API would catch the oddity around accounts it requested info for vs. account numbers you said to transfer to.

There are a lot of layers any such attack would have to go through, in the end scrubbing out anything much useful (which is what we see with the results). I'm not saying there's no risk, I'm saying that the system as a whole does a good job of having enough layers of security that it's very hard to get something really malicious in place.

Re:How would you do that exactly?

[AmiMoJo]

Thanks to Snowden we know that the NSA and GCHQ like to trick developers into installing hacked versions of XCode, which inject NSA/GCHQ malware into compiled applications. Their goal appears to be to get some zero-day malware into popular applications, allowing them to remotely 0wn huge numbers of iOS devices.

So while iOS security may protect users to some degree, I wouldn't bank on it where the NSA and GCHQ are concerned. They likely have zero-day exploits that can subvert iOS security, otherwise why bother going to all this trouble?

Those guys are well known for putting theory into practice. They read that famous "Trusting trust" paper and thought it was an instruction manual. That's the most important aspect of this story that seems to have been missed.

Re:How would you do that exactly?

[macs4all]

There are a lot of layers any such attack would have to go through, in the end scrubbing out anything much useful (which is what we see with the results). I'm not saying there's no risk, I'm saying that the system as a whole does a good job of having enough layers of security that it's very hard to get something really malicious in place.

Witness the fact that XCode has been offered for free since 1999 and this is the first time it has been compromised.

Re:How would you do that exactly?

[narcc]

As far as you know...

Apple has a sketchy security track record. Like Linux, it benefited from being an unattractive target as it had such a tiny user-base. OSX still does. As for iOS, for a while there, you could root the damn thing by visiting a webpage.

That is, their products are not an attractive target for malware. When someone bothers, they're usually successful. See: pwn2own for countless recent examples.

Aside from the microscopic market share, Apple is just like everyone else.

One other point - more secure than server

[SuperKendall]

One thing I meant to add is; because all the interesting attacks happen around what the application actually does, you have to ask is the attack easier to perform though Xcode, or attacking the server the app communicates with. Just like in a bear attack you only need to run faster than the person you are hiking with, to avoid a security breach you just have to be more secure than the server you work with.

For any given attack (like trying to attack a bank app) why would it not be lots simpler to hack the website, or API server? If you get in you get everything, not just one version of the app. It's way easier to hack a website than to do a custom build of Xcode, find a developer system and social engineer them to install some kind of malicious alteration.

Re:Free as in $5 to $15 per GB?

[Anonymous Coward]

Why the fuck is Seattle like a 3rd world country? Well, at least McDonald's employees make 15$ an hour tho!

Everything is always wrong during development

[SuperKendall]

Yea, developers don't do that unless they have a reason to believe something is wrong.

When you are developing there is ALWAYS something wrong. I have used web proxies and other performance monitoring tools, not to mention the debugger, countless times during the development process because I have to figure out why any one of a hundred things are wrong/slow/simply not working.

That's especially true with any software that needs to talk to a server, which is pretty much any app these days. Even if there's not a bug you use web proxies to verify it's sending what you think it is sending, or to show the server guys who generally do not believe you anything can be wrong with the server the exact traffic going to and from servers.

When you are in the debugger the whole app is halted, with the stack traces of all threads visible...

Not impossible to hide something in there, no, but it all adds to the difficulty.

Not on iOS they don't

[SuperKendall]

Generally I'd agree with you.

But the prompting on iOS is clear enough that many people actually do click no - especially for things like location, which people know uses battery. Or contacts, which is very easy to say "no application you do not need to see my contacts".

And again, all this prompting happens at the time the resources is requested. So if permission is asked for later it's especially odd.

Re:Not on iOS they don't

[Anonymous Coward]

LOL, you give people too much credit.

I remember a branch manager of a sales team asking me (the resident tech nerd) whether or not to allow an app to get his contacts on his i thing.

The fact that he had to ask me tells me he has no idea if he should click yes or no. Most would just click YES to proceed.

Re:Not on iOS they don't

[Anonymous Coward]

Except your branch manager asked, this is better than androids ask for everything during installation.

Re:Not on iOS they don't

[macs4all]

LOL, you give people too much credit.

I remember a branch manager of a sales team asking me (the resident tech nerd) whether or not to allow an app to get his contacts on his i thing.

The fact that he had to ask me tells me he has no idea if he should click yes or no. Most would just click YES to proceed.

You, sir, are an effete snob. The VERY thing you ascribe (wrongly) to Apple owners with your snarky "i thing" remark. You wouldn't have referred to his phone as an "a thing" if it were an Android.

And the fact that he actually ASKED you means that he RECOGNIZES that he shouldn't just blindly click "OK" to every security prompt he sees.

Far from deriding him, you should be PRAISING his diligence, you insensitive clod! You WISH all Users were as DILIGENT as he.

Fucktard.

Re:Not on iOS they don't

[Anonymous Coward]

Cry moar.

Re:Not on iOS they don't

[Anonymous Coward]

I prefer to be asked at installation time. That way I don't waste my time with apps that want too many permissions.

Re:Not on iOS they don't

[macs4all]

Cry moar.

Pretty sad when you can't even spell "more".

You are an insult to all the true morons (IQ under 70) on the planet.

Re:Not on iOS they don't

[Anonymous Coward]

It's pretty sad when you're told to cry moar and do exactly that.

Re:Not on iOS they don't

[macs4all]

It's pretty sad when you're told to cry moar and do exactly that.

This is EXACTLY why most Slashdotters ignore/filter ACs.

I have resisted it until now; but I guess I'll sadly have to adopt that policy, too,...

Hey Slashdot! ACs are RUINING this Site!!!

GET RID of THE AC POLICY NOW!!!

Re:Not on iOS they don't

[KlomDark]

Pretty sad when you don't realize that "cry moar" is a relatively standard meme. The misspelling is intentional.

Download once and use USB

[SuperKendall]

You can easily download Xcode, put it on a USB stick, and share it with others. I do that with every build. Using a modern USB3 memory stick it will copy fairly rapidly.

Has anyone ask who was behind the attach?

[Anonymous Coward]

No one seem to be asking the question, is this an attack sponcered by the
US government in retaliation for Apple's position on encrypting their iPhones.

The NSA lost a a very effective intelligence asset, Don't you think they would
want another way into Apple's iPhone networks?

No I don't often wear an aluminum foil hat, but when I do I prefer reynolds .

Re: Free as in $5 to $15 per GB?

[Anonymous Coward]

Just move. Most of the people here don't like the Internet so things are not going to improve. I'm looking for a job somewhere I can get decent access.

Re:Free as in $5 to $15 per GB?

[Anonymous Coward]

There you go - you can pay someone $15.01/hr to, instead of working at McDonald's, sneakernet your Xcode.

Re:Free as in $5 to $15 per GB?

[sribe]

This! We're still updating a dozen dev machines to XCode 6.4 for iOS 9 support. It looks like it is going to take two weeks since we're in Seattle and stuck sharing an ISDN line between almost twenty people. I wish Apple had a solution where you could download the update once then redistribute it.

They do, if, you know, you would bother to look in the "downloads" section of your developer account.

Re:Ironically this was caused by slow XCode downlo

[jpellino]

"Downloading XCode from the Mac App Store takes nearly a full day!" I get it and the accessory files in about an hour. YMMV but a day? Where?

Re:Free as in $5 to $15 per GB?

[Dog-Cow]

You can just package up Xcode.app and distribute it on floppy... er, USB key. It's not that hard. The betas are packaged as DMGs, which are also easy to pass around.

If you know so little about how to do basic file management on a Mac, perhaps you shouldn't be developing apps.

Re: Free as in $5 to $15 per GB?

[Anonymous Coward]

You're an iOS developer and you weren't aware XCode7 came out when there were betas available to registered devs all summer? Yeah, sounds like you're pretty serious about app development...

NSA?

[Anonymous Coward]

Wasn't there a slide in one of the leaked "Snowden" documents about the NSA wanting to hack xcode to sneak data collection tools into apps....

Alternatives

[jpellino]

"I wish Apple had a solution where you could download the update once then redistribute it." They do. Two in fact. Once it's on your own network, use Caching Server inside OS X Server. $20. Worth the savings in aspirin alone. Or ARD. Similarly cheap. Outside of Apple, sneakernet. Store apps like XCode only care that you bought them and they they are intact on the drive. I did this for several large in-the-store, non-installer-based, free-with-OSX apps (GarageBand, iMovie) in a building that shared a 10-base fiber link across 18 machine and I wanted to get home for dinner.

Re: Ironically this was caused by slow XCode downl

[Anonymous Coward]

He said chinese developers so i am assuming china.

Re:Duh

[Anonymous Coward]

It is free if you have a Mac. So it is "free".

So how do you determine if there's examples?

[Anonymous Coward]

Serious question here...

How did they know information wasn't sent random places?

Re:Ironically this was caused by slow XCode downlo

[MisterSquid]

Some Chinese developers downloaded this tainted XCode because of slow download times of XCode from the Mac App Store.

Downloading XCode from the Mac App Store takes nearly a full day! I think this delivery mechanism of XCode is developers is very crummy and quite a nuisance.

Maybe it's an effect of the Great Firewall? My understanding is that Internet throughput in China (especially for inbound traffic) is very unpredictable with speed varying not only across time but also on physical location.

Re: Ironically this was caused by slow XCode downl

[Anonymous Coward]

China. Connected to the outside nworld can sometimes be very slow. Like kbps slow. Especially when it's for downloading updates on a secure connection. Sometimes if a major event happened and they don't want the news to spread secure connection s literally stop working.

Re:Free as in $5 to $15 per GB?

[Ukab the Great]

I think he meant free as is in "Xcode has such a great GUI builder with a great IDE that has great features vi and emacs lack, that it frees me up to do other things in my job/life." As the old Jamie Zawinski saying goes "Linux is only free if your time has no value."

Re:Duh

[Anonymous Coward]

> The only thing you pay for is the $99 to distribute applications...

$99/year, *every* year. If you stop paying, your app is *removed* from the App Store (but not people's iDevices!). This makes creating a free app for iDevices a *bit* more expensive than it should be.

Hashing System Libraries

[friedmud]

I wonder if it would be possible for XCode to compute a hash of system libraries / executables that is then embedded into the App binary. Apple could then check this hash against what it should be and reject any app that was compiled with a bogus version of XCode or system libraries.

Might not stop everything... but it could be a start.

Re:Hashing System Libraries

[Anonymous Coward]

Yep.

And also possible for a "rogue" version of Xcode to embed the known hashes of real system libraries/executables, because it's not like there isn't enough real copies of Xcode around, or that it's hard to get hold of. Get someone to download it in a country with better net access, send you the hashes, embed them into your version of Xcode and watch while people download it.

And again, it would actually put the bogus version ahead, because by using pre-computed hashes and not doing it on the fly it'd actually compile slightly faster.

Re:Hashing System Libraries

[angel'o'sphere]

Yeah, and I would simply include the correct hashes, from the "original (second)" XCode Installation.

What you would do in the Java world is signing all classes, however I guess that won't help much as I assume the "hacked XCode" simply added an additional lib.

That could be compiled freshly all the time and signed with the developers key, then the Trojan/Virus looks like the develoepr had written it.

Re:Duh

[jonwil]

Does Apple actually allow you to run an app on your own iDevice without paying the $99 fee? I thought you had to pay it even if you were developing and testing on your own iDevice, not just if you wanted to distribute it.

Re:Duh

[printman]

No more, they made the change earlier this year (I think at the last WWDC) and also combined the different developer programs so you don't need to pay a separate iOS and Mac developer (distribution) fee. So now you can just download the free Xcode software and compile and install to your own devices/computers without paying a penny to Apple.

Re:Ironically this was caused by slow XCode downlo

[Malc]

I think it was 10-15 minutes for me. But I digress...

If these people were able to download the infected alternative faster than from the App Store, then the real question is why? Is this a consequence of the Chinese government's internet interference?

Re:Ironically this was caused by slow XCode downlo

[drinkypoo]

If these people were able to download the infected alternative faster than from the App Store, then the real question is why? Is this a consequence of the Chinese government's internet interference?

I was just discussing this on G+, and that's the claim, all right. Which makes you wonder, was this hack by the chinese government? Or just someone taking advantage of the situation they've created by leaning on their people so hard and denying them any and all freedoms which might be the slightest bit inconvenient for the power elite?

Re:Ironically this was caused by slow XCode downlo

[gweihir]

If Apple had PGP-signatures on it, and the developers verified them, it would not matter where they got the XCode package. But yes, the slow download is a risk in itself, namely incompetent people taking shortcuts like happened here.

Re:Ironically this was caused by slow XCode downlo

[jeremyp]

Xcode is signed. However, you can turn off Gatekeeper or temporarily override it while you run Xcode for the first time.

Re:Ironically this was caused by slow XCode downlo

[Rosyna]

Xcode is signed and Gatekeeper warns about a corrupted binary. The issue is that these developers that were infected intentionally disabled Gatekeeper checks so they could run the infected Xcode.

Re:Duh

[jo_ham]

This is exactly why development tools shouldn't be paywalled. Your fault, Apple!

Today I learned that $0 is a paywall!

No wonder things are so expensive!

Re:Duh

[jo_ham]

Does Apple actually allow you to run an app on your own iDevice without paying the $99 fee? I thought you had to pay it even if you were developing and testing on your own iDevice, not just if you wanted to distribute it.

Yes it does.

And as of iOS9 you can side load apps onto your device without paying as long as you build from source.

Comment removed

[account_deleted]

Comment removed based on user account deletion

There's no such thing as perfect security.

[Brannon]

It doesn't mean that there's no value in imperfect security. Apple's walled garden failed in this attack, but it succeeded in thousands of other cases. The infected apps will be removed from devices and the app store, the hole will be closed.

Those are all pretty horrible ideas.

[Brannon]

The answer is NOT to present customers with fourteen more layers of pop-ups and train users to just hit 'accept' on everything. The answer is NOT to load down our mobile devices with anti-virus software, most of which are worse that most viruses. The answer is NOT to expect users to become experts on technology.

Those are the failed ideas and policies of the Windows world. Android is trying hard to make most of the same mistakes. They are horrible, horrible, ideas and it's scary that there are some in the tech community that are still advocating them.

Apple's current model IS the answer. Just look at the stats of malware/virus infections of Apple devices vs. Windows or Android. But nothing is perfect, there are going to be occasional infections.

Re:Those are all pretty horrible ideas.

[narcc]

A much better solution, impossible on iOS, is to have multiple (smaller) third-party curated stores where better QA can be assured. A single massive store with thousands of submissions per day is a recipe for failure. Given the size, you'd very often spend far more per app review than you'd likely recover from sales if you wanted to keep low-quality and malware infested apps out.

Re:Ironically this was caused by slow XCode downlo

[MachineShedFred]

I would hope that a developer would know better than to allow an allegedly Apple-published app to continue to run when Apple's own security measures are warning you about it.

But then I remember that most software developers are complete knobs.

Re:Free as in $5 to $15 per GB?

[MachineShedFred]

They do.

Download Xcode.app, don't run it after it downloads. Copy Xcode.app to other machines via USB key. It self-installs the first time you run it.

Re:Ironically this was caused by slow XCode downlo

[macs4all]

Xcode is signed and Gatekeeper warns about a corrupted binary. The issue is that these developers that were infected intentionally disabled Gatekeeper checks so they could run the infected Xcode.

So were they unwitting participants in the scheme; or was this the Developers' plan all along, and they just got caught?

Re:Free as in $5 to $15 per GB?

[BitZtream]

that Apple switched from GCC to LLVM specifically to avoid copyleft.

Yea, they wanted an open source compiler instead of the GPL crap. So they went from GPL to BSD ... are you seriously trying to claim thats proprietary? If so you're just making yourself look retarded. Not stupid, flat out retarded.

You probably meant "Xcode is free as in without charge." That's true if your home Internet lacks a quota or has dozens of GB per month.

Apple will allow you to download it in their stores for free.

But if you're stuck behind cellular or satellite Internet, such as in a rural area or urban Seattle, multiple gigabytes can become very expensive to download.

And that changes any of this how? Regardless of where you download it from, you're going to be downloading it and thats going to cost. You've not described anything that justifies downloading it from someone other than the source.

You're just a shitty hater, you can't even find actual flaws to pick on.

Not sure why size of the story matters.

[Brannon]

The critical consideration is whether the company that operates the store invests enough money to maintain a high level of QA. Apple makes that investment (even for free apps) because it helps with sales of hardware (which is where they make all the money) and thus can be subsidized by hardware sales.

Re:Not sure why size of the story matters.

[narcc]

Smaller, particularly community operated, app stores can handle QA far more thoroughly and efficiently.

  Given the generally low quality of app store apps, it's pretty obvious that Apple's investment is minimal. This should come as no surprise, as they "review" thousands of apps every day. I guarantee that they're not investing more in QA than they pull in from app store revenue. It's likely more in the "as little as possible" range.

They're in business to make a profit, after all. They're not some mythical omnibenevolent entity.

Franchised stores too?

[tepples]

Apple will allow you to download [Xcode software] in their stores for free.

Is this true only of Apple's own stores or also of independent Apple authorized dealers?

Regardless of where you download it from, you're going to be downloading it and thats going to cost.

There's a difference between downloading what you need and downloading it all. Or has Xcode been factored into components that can be downloaded and installed as needed? And there's also a difference between downloading once for a neighborhood or office and downloading once for each Licensed Computer.

Re:Free as in $5 to $15 per GB?

[macs4all]

Xcode is free.

Since when? I thought it was proprietary software, that Apple switched from GCC to LLVM specifically to avoid copyleft.

You probably meant "Xcode is free as in without charge." That's true if your home Internet lacks a quota or has dozens of GB per month. But if you're stuck behind cellular or satellite Internet, such as in a rural area or urban Seattle, multiple gigabytes can become very expensive to download.

Now you're just TRYING to find excuses to justify your "Not REALLY Free" assertion.

It is as free as Apple can reasonably make it.

Or perhaps you'd like to go back to the bad old days when you had to have a REALLY expensive Subscription (IIRC, it started at $500/yr... and UP!) to get the Monthly Developer CDs mailed to you.

So, by your estimation, and your point of view, is there really ANY truly free software on this planet?

Re:Free as in $5 to $15 per GB?

[macs4all]

> urban Seattle, multiple gigabytes can become very expensive to download.

This! We're still updating a dozen dev machines to XCode 6.4 for iOS 9 support. It looks like it is going to take two weeks since we're in Seattle and stuck sharing an ISDN line between almost twenty people. I wish Apple had a solution where you could download the update once then redistribute it.

They do. And if you were even a marginally-competent Developer, you'd already have figured it out.

All that is happening is that a .pkg file is being downloaded. It's not rocket surgery.

Go somewhere that has reasonable internet, download the .pkg file, put it on a local network resource or even a fast USB Stick or portable drive, and VOILA!

Heck, if you would get a crowbar into your wallet and pry out $70, you could do it all from a central location using Apple Remote Desktop. Of course, if your Dev. machines are spread out all over the place, then you fall right back into the slow internet thing. But if they are all in and around Seattle, then sneakernetting a copy of the XCode .pkg bundle around town may be faster than dealing with multi-day downloads...

Amortizing download costs with sneakernet

[tepples]

For applications obtained through an App Store, the ISP can bill each person who downloads a copy the full cost of downloading one copy. If 25 people in a neighborhood or office each download one copy, the ISP charges for 25 copies.

For applications distributed under a license permitting redistribution, be it a free software license or not, a user can legally download one copy and sneakernet it to the rest of the neighborhood or office. This amortizes the cost of downloading over an entire neighborhood or office. If it can be shown that Apple permits redistribution of unmodified Xcode software to other Mac owners, I hereby retract my prior claim.

Re:Duh

[macs4all]

> The only thing you pay for is the $99 to distribute applications...

$99/year, *every* year. If you stop paying, your app is *removed* from the App Store (but not people's iDevices!). This makes creating a free app for iDevices a *bit* more expensive than it should be.

So charge $1.30 for it, and it 100 people buy it a year, then your Dev. license is essentially free.

If people won't pay less than a large coffee at the gas station for your work, then it must be pretty sucky. Personally, I'm not rolling in money; but I will drop up to $5 for an app that I'm even mildly interested in.

If you feel like being altruistic and charging zero for your time and effort, then don't whine about incidental costs you incur along the way.

Apple charges that $99 not because it fills their coffers with significant cash; but because it HELPS keep people who are not serious about creating Apps out. Yes, even fart Apps.

What color are your bits?

[tepples]

XCode could care LESS

It's not about what the Xcode software technically implements. It's about what a BSA audit could uncover. True, the bits of a licensed copy of Xcode downloaded from Apple are exactly the same as the bits of an infringing copy obtained through sneakernet. But an audit would uncover that the bits are a different color, and Apple has the right to sue over the use of incorrectly colored bits. Bit color is a legal construct, not a technical construct. This might be discovered if someone in your office is discovered to be using Xcode on a computer for which no successful Xcode installation is recorded in Mac App Store.

Just because something isn't Open Sores, doesn't mean that it's DRMed.

Nor does just because something isn't subject to technical DRM mean it's legally free to redistribute to all comers.

Re:Duh

[macs4all]

Does Apple actually allow you to run an app on your own iDevice without paying the $99 fee? I thought you had to pay it even if you were developing and testing on your own iDevice, not just if you wanted to distribute it.

The only time you have to pay $99 is to be able to SUBMIT Apps. With Ad Hoc Provisioning, besides being able to "Distribute" to yourself, you can even Distribute to up to 100 iOS Devices directly without involving the $99.

It's a pretty well-thought-out system, actually.

Xcode came with Hackintosh software?

[perpenso]

Other than laziness there is no good reason for people to get their Xcode anywhere else than apple (as Xcode is a free download).

I wonder if this was part of a Hackintosh set of software, a Hackintosh being Max OS X running on non-Apple hardware.

Re:Xcode came with Hackintosh software?

[phayes]

No. Xcode isn't included in OS X. The boobytrapped Xcode version was a separate download & now everyone knows that they need to download directly from Apple & not some dodgy site in China.

Xcode not just from App Store

[perpenso]

Apple DOES offer hashes/signatures on their regular Downloads; but not for stuff that is distributed through the App Store (which XCode now is).

Xcode is also available as a download from Apple's developer site. The App Store is not required. This developer site is where access to beta versions and "golden masters" may be found. These allow developers to target an upcoming iOS version many months prior to an iOS update and to build and submit to the app store an app built with the official public version of Xcode immediately prior to the iOS update in order to be available on launch day. Plus legacy versions of Xcode are also available in case someone needs one to debug on an older version of iOS. For example Xcode 7 only includes simulators for 9.0, 8.4, ... 8.1.

Large devs may internally distribute Xcode

[perpenso]

It seems that one of the affected parties was Tencent, hardly a small developer and unlikely to be using "dodgy" versions of XCode.

Actually its entirely plausible, even likely, that large developers keep Xcode downloads on their local servers for their internal developers. Or have standard suites of software including Xcode that corporate IT puts on internal developer machines. One would only need to infect the Xcode on the server or in this standard suite.

Not surprised, and this isn't the only incident!

[Anonymous Coward]

Back during the days of the 3GS, I identified an app in the App Store that was finding ways to hijack passwords. I spent a long time on the phone with Apple, at different times, and they cleverly danced around the issues. It was as if they were purposefully stalling, in hopes I would get frustrated and give up--which I did. So the above doesn't surprise me -- though, I still feel the Apple App Store is far safer than the Droid equivalent.

Re: Free as in $5 to $15 per GB?

[Anonymous Coward]

On the bright side, your 17 Meg file should be done copying by then.

Re:Ironically this was caused by slow XCode downlo

[gweihir]

I am wondering the same thing.

Obvious question: the list?

[ruir]

So a piece of "news" does mention about lists several times, but where the fuck are them?

Only iOS 8+

[Anonymous Coward]

I'll be willing to bet iOS7 isn't affected. Back then apps couldn't talk to each other as easily..

Status

[Anonymous Coward]

People don't care about any of this bullshit when they are buying a new phone. They just want to know if it will make their friends jealous.

That's absurd.

[Brannon]

There's nothing magical about being community operated. There are a lot of community operated app stores doling out metric tons of malware right now on Android, Windows, and jailbroken iOS.

Sure, it's possible for a small community to create a clean and well maintained app store--but who certifies which 'community app stores' are clean and well maintained? If your answer is 'the end customer' then that puts us right back where Windows and Android are--you have to be an expert to use your phone. It is a failed system. You know what is an outrageously successful system? Apple's walled garden. I've yet to hear an alternative that wasn't just a thin repackaging of the failed Windows and Android app ecosystems.

Re:That's absurd.

[narcc]

who certifies which 'community app stores' are clean and well maintained?

Isn't it obvious? The community that operates and maintains the store!

You know what is an outrageously successful system? Apple's walled garden.

Except for the thousands of malware infected apps -- including many popular apps. Oh, and discovery. That's a big one. There's also the censorship. That's pretty nasty. The endless sea of low-quality apps. I'll bet I could go on...

I've yet to hear an alternative that wasn't just a thin repackaging of the failed Windows and Android app ecosystems.

Microsoft's store "failed" because they tried to mimic Apple's walled-garden. Had they not been openly hostile to developers (like Apple) they'd have seen a lot more success. If they have any sense, they'll open things up a bit.

  I'm not sure how Android failed. As far as I can tell, they're an unparalleled success. Amazon's store stands out as an excellent example of what a good third-party app store can be -- handily beating out the Google's Play store in terms of quality.

Delusional.

[Brannon]

Any malware statistics you can find show that iOS has dramatically less malware than Windows or Android.

Amazon's store is fine, but it doesn't matter if one store is okay. You need devices locked to only the "safe stores" or you need customers to be really careful about which stores they download apps from. So, basically, you either need a walled garden model or tech savvy users. Since the whole point of the discussion is how to safely roll out smartphone tech to everyone then the latter option is not really an option.

QED.

Re:Delusional.

[narcc]

You're missing the entire point. All the big stores have malware. When you're processing thousands of app submissions a day, and don't want to spend far more than you'll make, quality falls dramatically.

This is the great failure of Apples walled garden. Unfortunately, with Apple, there's nothing you can do about it. You're stuck with their malware ridden market. This is not the case for other platforms where you do have the option to use other marketplaces.

You need devices locked to only the "safe stores" or you need customers to be really careful about which stores they download apps from.

The problem with locking users to only the "safe stores" is that it's impossible as those "safe stores" are obviously not safe. Due to their scale, it's impossible (at least wildly impractical) to make or keep them safe.

The walled garden clearly doesn't work. In retrospect, it was doomed to failure.

Any malware statistics you can find show that iOS has dramatically less malware than Windows or Android.

Microsoft uses the exact same walled-garden approach as Apple. No surprise, they both have malware. Google Play is loaded with malware for the exact same reason that Apple's market is loaded with malware (see above).

Now, what makes a walled-garden superior to a curated store? For users, the answer is "absolutely nothing". You get the exact same benefits from a curated store. The difference? With the walled-garden, you're stuck. You're stuck with malware, an endless sea of low-quality apps, censorship, and a host of other issues. There is no justification (that benefits users) for locking users to a single marketplace.

Outside of the XCodeGhost stuff, there is no

[Brannon]

malware on iOS. There have been something like 6 total reported cases in iOS history where something slipped past the checks--all of those were pretty much immediately removed.

The XCodeGhost was a new attack vector and managed to infect many apps. Those apps will also be cleaned up and that attack vector will be eliminated.

It is just patently false to claim that the walled garden approach doesn't work. It's the only thing that does work. You are being intellectually dishonest.

Re:Outside of the XCodeGhost stuff, there is no

[narcc]

There have been something like 6 total reported cases in iOS

The key word here is "reported". Just as an example, Apple's reported figure in this case is dramatically lower than every other security research group.

Those apps will also be cleaned up and that attack vector will be eliminated.

That remains to be seen. I'd wait for something other than wishes and good feelings.

It is just patently false to claim that the walled garden approach doesn't work.

Considering that it clearly hasn't worked I'd say you're in denial.

It's the only thing that does work

Except, as you can see, it has not worked.

You are being intellectually dishonest.

I'm being intellectually dishonest? "This wall keeps monsters out of the garden" "But there are clearly monsters in the garden" "No! This wall has not failed!"

Still, you're ignoring my entire previous post. To recap: There is no advantage to a walled garden that is not also shared by a curated store. Not one. There are, however, many serious problems with the walled garden approach that are not shared by the curated store approach. (As I explained earlier.)

Walled garden == curated store.

[Brannon]

I don't understand what you are talking about. The only difference is that Apple makes it very hard to load apps except through their curated store; specifically to avoid creating additional attack vectors.

Security isn't about perfection. It never has been ever before in the history of mankind. The average Apple user is much less likely to experience malware than the average Android or Windows user--that's not something I'm willing to debate anymore than I'm willing to debate whether 2+2=4--the statistics are out there and they are compelling.

I think the problem here is that you don't understand technology. Probably because you're 14.

Re:Walled garden == curated store.

[narcc]

I don't understand what you are talking about. The only difference is that Apple makes it very hard to load apps except through their curated store;

That's no so hard, is it? The walled-garden offers no additional benefits to the user. Now, consider the litany of additional problems caused by allowing only one marketplace I mentioned above.

specifically to avoid creating additional attack vectors.

That's foolish. The purpose is ensure Apple gets a cut of app sales. This has lead to the host of other problems, as I explained earlier.

Security isn't about perfection. It never has been ever before in the history of mankind. The average Apple user is much less likely to experience malware than the average Android or Windows user

I'm glad that you're finally able to accept that the walled-garden approach does not work, and that any advantage it offers is shared by any other curated store. Now, why doesn't Apple have the same malware problem as Android and Windows?

The same reason desktop Linux doesn't suffer from serious malware issues: Their microscopic marketshare makes them an unattractive target for malware. iOS and OSX combined sit at around 10% of devices shipped. If you were in the malware business, they're just not worth your time.

Are they more secure? Well, no. That they consistently fall in contests like pwn2own indicates that they're just as vulnerable as everyone else. They're not magic, after all. That's why it's important to have a safe marketplace.

Now, this all started because I suggested that smaller, community operated, stores would be better able to keep malware out than larger stores. The reason being that smaller stores can dedicate more QA resources per app than larger stores as they're processing few apps. Apple and Google deal with thousands of submissions every day. They've had to sacrifice review quality to deal with the volume -- and it shows.

The solution for users, tired of dealing with the sea of low-quality apps and malware, is to simply use a different marketplace. This is possible on other platforms, but not possible on iOS. The walled-garden has failed it's users. They're now trapped within its gates with no means of escape.

Do you think the ghost of Steve Jobs is going to come charging in on the back of a white horse and save those poor users? Do you think they'll have an attack of conscious and spend far more per app review than they'll see in revenue? Or do you think they'll downplay their malware problem, telling a different story to their users than other security research groups, and hope their users don't notice? I'll give you hint: They've done one of these things.

What's scary is you think you're smart.

[Brannon]

1. Apple doesn't make money off of apps, they make money by selling hardware. Their only interest in having a locked down app-store is so that iOS will be perceived as the "safe, virus & malware-free approach". I know it's really hard to understand how a company can make money by selling real physical objects because we've all been so conditioned into thinking that you can only make money off of software and ads.

2. iOS is a gigantic market. Android has more users but those users don't have any money. Dramatically more money is spent by iOS users (on apps and everything else) than by Android users. You are incredibly naive to think that iOS is not a big enough target for virus/malware authors.

3. This is how I know you're a child, because you think that if there's a tiniest chink in the armor then the armor is useless. It's really common for kids to have this perception because their brains are under-developed, can't see shades of gray, and thus can't comprehend that there can be a lot of value to imperfect security. Hopefully at some point in your intellectual development you'll understand that ALL SECURITY IS IMPERFECT. As of right now your brain is just not capable of processing that.

Re:What's scary is you think you're smart.

[narcc]

Apple doesn't make money off of apps

Wow, you're confused. They absolutely make money on apps. They sure as hell aren't going to lose money on them! As for QA, a quick trip through the store ought to show you how great they are at that. It's been a sea of garbage since inception -- now with bonus malware!

You are incredibly naive to think that iOS is not a big enough target for virus/malware authors.

The volume of users counts, not how much money they spend. iOS users make up a tiny fraction of the mobile market. Remember when BlackBerry was king? Those users had money, and spent money. They were also too small a market to be worth targeting. Remember: with the exception of Apple, users don't pay for malware.

because you think that if there's a tiniest chink in the armor then the armor is useless [...] ALL SECURITY IS IMPERFECT.

This is how I know you have difficulty reading. iOS security is imperfect. Their walled-garden did not keep their users safe. Their users traded their freedom on the promise of security, thanks to Apples undeserved reputation. Now, those users are trapped. They have no alternative. With other platforms, they can opt to use different, safer, marketplaces when the pack-in inevitably turns in to a cesspool.

This is my entire point. Alternatives are essential. Smaller, community driven, marketplaces can actually deliver on the promise of a clean marketplace as they can devote more time and effort toward each submission. Apple and Google simply can't. The expense is far too great. With Apple, the situation is worse, as users can not escape their marketplace ghetto. They're trapped behind those garden walls with the low-quality apps and malware monsters.

This isn't complicated.