iOS Bug Allows Malware to Be Sold in Apple App Store

[Guest]

Neat trick came at a price.

iOS Bug Allows Malware to Be Sold in Apple App Store : Read more

 

[cumi2k4]

Didn't Apple heard of old adage "don't shoot the messenger"?

 

[Scanlia]

I thought Apple was controlling and secure....

 

[stonedatheist]

Banning a white hat hacker that is helping them find potential threats in their OS? Apple has sunk to a new low.

 

[Goldengoose]

Apple and their actions just remind me of a child. Give them advice and they throw it back in your face, have something they don't and they throw a tantrum and ask mummy to sort it (the current state of patents and courts).

 

[molo9000]

He shouldn't have made this public before Apple fixed it.

 

[Guest]

Technically speaking, he did contravene the terms and conditions of the agreement. What did he expect would happen? That Apple would welcome him into the fold/offer him a job in the security department and pat him on the head?

 

[digisol1]

Looks to me he went and tried the proper channels and they were not receptive. To bad he is white hat, the skiddies will prolly leave apple alone - ask Sony how well it worked out for them when they went after geohot.

 

[ojas]

i really appreciate anyone who exposes security flaws in Apple's software/devices because they keep acting like they're not vulnerable.

Yesterday, Miller tweeted that he'd been kicked out of Apple's iOS developer program.

While Google pays for each vulnerability that people discover in Chrome. I hope Miller embarrasses Apple real bad next time.

 

[hetneo]

And people like to say that Apple's security policy is not "if you don't know about it, it will not hurt you".

 

[house70]

[citation][nom]scanlia[/nom]I thought Apple was controlling and secure....[/citation]
No, it's just controlling.

 

[house70]

[citation][nom]thekanester[/nom]Technically speaking, he did contravene the terms and conditions of the agreement. What did he expect would happen? That Apple would welcome him into the fold/offer him a job in the security department and pat him on the head?[/citation]
Apple made the terms and conditions you mentioned, they could have bent their own rules for the greater good (and their own). It's not about that, it's about their stupid pride and claim they're secure by default; when someone points at the holes in their shoes, this is the answer.

 

[watcha]

[citation][nom]house70[/nom]Apple made the terms and conditions you mentioned, they could have bent their own rules for the greater good (and their own). It's not about that, it's about their stupid pride and claim they're secure by default; when someone points at the holes in their shoes, this is the answer.[/citation]

This is nonsense. He didn't get banned for finding the problem, pointing the problem out, or even telling them the problem, all of which he should have done. He got banned for deliberately adding an app to the app store which can leave any users phone vulnerable.

By banning him, Apple could have anticipated that it would get far more publicity and it's therefore clearly not an act of 'denial' or being 'controlling' or trying to stop people 'knowing about it'. They banned him to make it perfectly clear that while finding a virus is acceptable, deliberately spreading said virus is not. There is a big, big difference.

If someone finds an exploit in some software which can be exploited, they should simply develop a proof of concept, and privately demonstrate it to the company. Contrary to one or two misinformed comments on this comments section, he did not do this, but instead decided to go one step further and leave the mass market vulnerable to the virus. This is obviously, clearly irresponsible, and Apple were left with no choice but to stop him doing it

Ironically, Charlie Miller has repeatedly stated that iOS is far more secure than Android, so again that proves this isn't about trying to cover things up, it's just their only choice.

 

[watcha]

Also very interesting reading one of his recent tweets:

Quote:

'0xcharlie
@ioerror lol, cause google is nice, oh wait, they tried to get me fired when I reported my first android bug, nm.'

Seems like Google tried to take it one step further to sweep things under the rug.

http/twitter.com/#!/0xcharlie

 

[billybobser]

lollers, but no one ever hacks apple because they're so awesome.

I imagine stealing money from people already willing to get shafted by apple would be much more profitable than attempting this kinda thing on others.

 

[Guest]

@watcha the problem is that this security expert made it public by posting a YouTube video about the app on the App Store, the real hackers are just sitting back and reading your silly comment.

 

[nukemaster]

[citation][nom]watcha[/nom].....but instead decided to go one step further and leave the mass market vulnerable to the virus. This is obviously, clearly irresponsible, ......[/citation]
It was his own computer it linked too. I do not think he was sending out viruses. He did prove that the Apple screening process is still crap. If he can do it how many other apps are out there like this with a real payload on the other end.

He did tell them. they just did not care. It is hard to hear people when you and rolling in money....

 

[anonymous32111]

Sorta wish he just released malware without ever telling crapple about it, after the way they responded to this. Bad things happen to good people, so he must be doing something right.

 

[tramit]

[citation][nom]nukemaster[/nom]It was his own computer it linked too. I do not think he was sending out viruses. He did prove that the Apple screening process is still crap. If he can do it how many other apps are out there like this with a real payload on the other end.He did tell them. they just did not care. It is hard to hear people when you and rolling in money....[/citation]

And is that compared to the relatively non-existent app screening process of Android? Relatively the screening process is still a success and has minor flaws every now and then. I don't expect perfection in software ever.

 

[del35]

Apple itself is malware. The sooner we get rid of it, the sooner we will return to open standards and user accessible batteries...