Slashdot Mirror
Software Pirates Use Apple Tech To Put Hacked Apps on iPhones (reuters.com)
Pirates used Apple's enterprise developer certificates to put out hacked versions of some major apps, a report said Thursday. From the report: Illicit software distributors such as TutuApp, Panda Helper, AppValley and TweakBox have found ways to use digital certificates to get access to a program Apple introduced to let corporations distribute business apps to their employees without going through Apple's tightly controlled App Store. Using so-called enterprise developer certificates, these pirate operations are providing modified versions of popular apps to consumers, enabling them to stream music without ads and to circumvent fees and rules in games, depriving Apple and legitimate app makers of revenue. By doing so, the pirate app distributors are violating the rules of Apple's developer programs, which only allow apps to be distributed to the general public through the App Store. Downloading modified versions violates the terms of service of almost all major apps.
Someone should probably let the pirates know. I'm sure they'd like to comply.
This is the same thing that Facebook and Google were recently caught doing, except for even more illicit purposes. Apple hasn't been policing this space at all up to this point, since they've intentionally been hands-off with how enterprises choose to use their own certificates, so long as the enterprises keep their certificates to themselves. Now that it's clear that hasn't been happening, I suspect changes may be coming in the next year or two to how enterprise certificates operate.
Hackers are modifying software and allowing it into the hands of other users? This changes everything.
but did the users actually agree to the terms of service of the original app when they installed a modified version?
The weakest link in hardware/software security is people.
To summarize: people are a problem. - Douglas Adams (short version of the original to better fit the topic)
#DeleteFacebook
Here's an iPhone. Call someone who gives a shit.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
enabling them to stream music without ads and to circumvent fees and rules in games, depriving Apple and legitimate app makers of revenue.
Imagine, you're listening to something really interesting, which captures your entire mind, when an ad strikes...bam...!!!
Not good.
I would be most grateful if there was a way to cheaply stem these YouTube ads.
Google's fees in order to avoid them is insane. It's just costs too much.
The great thing about EULAs is that it's not illegal to break them. It's understandable that Apple doesn't want you to do these things, but we're free to do what we want with our purchased hardware from a legal standpoint.
Why doesn't Apple revoke the certificates and then provide new ones to the legitimate enterprises? Isn't that the reason Certificate Revocation Lists were invented - to stop the use of compromised certificates?
My hosts.txt-based ad blocker (AdAway) worked fine, before I moved it to my ARM home server that’s also its own independent DNS. (With my own CA and "cloud", faking Google's and Mozilla's services, among others.)
This is /., so it should be doable for you too.
Panda Helper
That people want to run stuff on their iPhones without having to get Apple's approval for it first?
I'll repeat. I think Google has the best model here. They run the Play Store for apps, and control what is/isn't allowed in that store. But if a user wants to run stuff installed outside the Play Store, they just need to change a single setting on their phone (which pops up a warning about what you are doing), and it'll allow them to install apps from other sources. It's up to the user to decide which apps they can/can't run.
Apple's model of forcing everyone to comply with their wishes is essentially a dictatorship. They decide what users can/can't do.
I'd count it as a good thing that there are some cracks in the Walls of the Garden...
computin dmu final exam by tilay