Apple mobile devices vulnerable to app. attack

[McBie]

Just saw this article ...

Apple mobile devices vulnerable to app attack, FireEye says - San Jose Mercury News

Again , nothing to be worried about if you download apps from the ' one and only ' Apple AppStore or directly from trusted developers' web sites.
Never install apps through web site pop-ups.

As always, the human firewall is the last barrier.

Cheers ... McBie

 

[vansmith]

This is a tricky one since it works by exploiting the one weakness in security - lack of knowledge on the part of users. This looks like a very easy breach of security to propagate since people can be easily enticed by the promise of free things, that importantly, look legitimate.

I'm going to guess that most users are unaware that apps ought to come from the App Store and that apps that don't are invalid. At a minimum, this highlights a hole in the authentication of installation on iOS. Here's hoping that this gets fixed in an 8.1.x bug fix release.

 

[McBie]

Very difficult to fix ( technically ) because people are free to install whatever they want..
And I don't envisage Apple to take note of each signature for the millions off apps that are out there.

People awareness is the only thing that can protect you from this.

Cheers ... McBie

 

[vansmith]

People awareness is the only thing that can protect you from this.

So, we're screwed then (not a criticism of people - you just can't get to everyone)?

 

[McBie]

Scr3wed in a way that you are becoming more and more dependant on the Apple eco system.
Is that good or bad ? Don't know really.
My priority is to enjoy my Apple devices and remain confident that they behave as expected, with minimal risk.

Cheers ... McBie

 

[chscag]

@McBie:

Maybe there's something here that I'm not seeing? I thought that unless your iPhone was jail broken, apps had to be installed from the iTunes app store? Once you jail break an iPhone, anything goes....

 

[osxx]

@McBie:

Maybe there's something here that I'm not seeing? I thought that unless your iPhone was jail broken, apps had to be installed from the iTunes app store? Once you jail break an iPhone, anything goes....

I thought the same thing in order to install an app outside of the App Store the phone had to be jailbroke.

 

[pm-r]

@McBie:

Maybe there's something here that I'm not seeing? I thought that unless your iPhone was jail broken, apps had to be installed from the iTunes app store? Once you jail break an iPhone, anything goes....

+1!!

And I understood that also applies to all iOS devices. Hmmm…???

 

[vansmith]

As far as I understand it, no jailbreak is required. All that's required is a malicious app that has a provisioning profile with the same ID as a legitimate app. That said, I have also heard that the device must be jail broken.

 

[McBie]

I am not sure if the device needs to be jailbroken or not.
They way I understand it, is that you can ( potentially ) load bad apps. that pretend to be legitimate apps.
At the moment I am not sure what the technical requirements are to achieve that.

I am sure we will hear more about this in the next few months.

Cheers ... McBie

 

[vansmith]

You need an enterprise developer account and possibly the UDID of the device. That's all I think you need.

 

[McBie]

Is there a list somewhere of all the enterprise developers ?
One of the national newspapers in Belgium has an iOS app. that is not ( yet ) on the Appstore and I am wondering if organisations like that are enterprise developers.

How easy is it to get an enterprise developer ID ( legally or not )

Cheers ... McBie

 

[vansmith]

How easy is it to get an enterprise developer ID ( legally or not )

$300/year and a DUNS number which, from I can tell, is free.