1 replies

$\"user-pic\"$

Riff Raff

@Oranges w/ Cheese wants it to be winter already:

Which part?

The idiotic, scammy company trying to pass off harvesting user data as a software bug?

Or the assholes with too much money on their hands that actually pay for in-game content instead of saving it or donating it to charity?

There's a reason it's illegal in games like WoW. It ruins the experience for those who play the game legitimately or those who don't have the cash to buy a million-bazillion Gold for $1,000. And this company is doing it intentionally...

$\"user-pic\"$

Kimaroo - 100% Pure Natural Kitteh

This has been at the back of my mind, and I thought of it because the apps can be made by anyone at all.

Apple may lose their, \"We're better than PC because you don't get viruses!\" motto soon.

I guess I really do have to be careful about what I download to my iPod touch. Who knows what kind of backdoors they could put into my iPod. That would really suck too because my whole life is on that thing.

3 replies

$\"user-pic\"$

parad0x360

@Kimaroo - Fortified with Kittydus Purrularis: Unless a user has jailbroken their phone and gained root access (this applies to Android phones as well) then there wont be any virus's. An app could harvest data but it cant damage the phone itself.

I dont know how the iphones app store works but on the Android app store before you download any app a security warning pops up and tells you what the app tries to access on your phone, for example.

Full Internet Access
Contact Data (reads contacts)
Messaging (can read and or send messages)

Thats just a couple of the warnings but it always make it clear what an app can do, so if you dont want to risk it then you dont download. Also it has an option to report malicious apps which Google reviews fairly quickly and removed them if needed.

Again unless a user has rooted their phone they dont have to worry about damage to the device. Even if they have rooted the phone they have to grant the app super user access (on android anyways) before it can do anything that effects system level files. When an app needs to run as a super user/admin a OS prompt pops up and you have to grant or deny its access.

$\"user-pic\"$

fantomesq

@Kimaroo - Fortified with Kittydus Purrularis: Um, no actually. While malware is always possible, at least Apple has procedures in place to prevent and/or control these misbehaving apps as they occur. The app review, the single source of apps and the surprisingly maligned app black list all help to ensure that the problems don't occur in the first place or if they do, their damage is contained. Compare that to the much ballyhooed 'open' nature of Android and others that have NO such protections.

Viruses are a whole other issue. There is no manner in which the iPhone can surreptitiously download, run and distribute an unapproved app so no threat of viruses... again on the other phones, no such protection... and do I have to mention, you have a full backup of your iPhone/iPod Touch on your computer, so worst case scenario, you wipe it and reload? The other phones? Yeah, you're out of luck.

$\"user-pic\"$

parad0x360

@fantomesq: Oh and yes Android does have such protection, in fact based on research I have done Android is more protected than the iphone. Not only does it have more system level layers of protection that cannot be bypassed unless a user roots the phone, no app can make any type of changes unless permitted to by the user via Super User prompts.

Please do some reading before you start posting about how amazing the iphones security is when compared to other smart phones because you are simply wrong.

$\"user-pic\"$

fantomesq

@parad0x360: I didn't say that Android lacks ANY protection. Every company tries to secure their software and kudos to Google for attempting to lock down their software from potential hacks, but as this story shows, no matter how well protected a company may think that there software is, holes undoubtedly exist and will likely be exploited.

The \"such protections\" I referred to included 1) a review process for the apps that can reject apps, 2) apps distributed from a single (controlled) source and 3) the ability to remotely shutdown rogue applications that slip past the aforementioned protections. I believe that Android lacks all of these.

My point was NOT that Android sucks - its not bad for an early revision (although the hardware leaves a lot to be desired) - but rather that the poster was incorrect in asserting that the iPhone was now somehow vulnerable to viruses because one company slipped an app through. Its simply not.

$\"user-pic\"$

rickhamilton620

@fantomesq: Android has a kill switch, even Windows Mobile apps installed via the new Windows Mobile Marketplace can be remotely deactivated and uninstalled.

$\"user-pic\"$

KreativeHitman13

Serves them right. Unless its disclosed somewhere, but i assume thats against apples ToS anyhow considering its an exploit. I wonder what they planned on using the phone numbers for. Spamming txt messages when new apps become available? Seems to me like that would get them caught though. I cant see a good reason for this.

1 replies

$\"user-pic\"$

WeAre138

@KreativeHitman13: it's definitely a big no-no for app developers to access anything outside of the sandbox that their sdk allows us to. Contact info us one of the forbidden areas. I don't even know how they could have done it.

$\"user-pic\"$

jdmba

and this is different than the millions of contests / quizzes / games on Facebook which are in place ONLY to get access to all of your information and information from your friends (unless they fixed their settings). Same same same.

1 replies

$\"user-pic\"$

KreativeHitman13

@jdmba: at least facebook discloses that its going to access profile information before they take it. not cool, but then again you dont have to use programs on facebook that do this. iphone apps doing it without you knowing is totally different

$\"user-pic\"$

dragonfire81

This is what makes me nervous about these kinds of cell phone apps, it's just another opportunity to have your information stolen.

$\"user-pic\"$

harknell

This is related to a bug and is not something regular programmers are supposed to be able to access. I know since I have a dev team who are working on apps. It's actually generally pretty difficult to get any specific details normally, and some types of actions you actually would want to have in an app as a user (like being able to move images to your photo roll) aren't always easy to do. Most stats gathering from apps are very generic like time used, os installed, and with some services where you are physically located (which requires the user to opt in).

2 replies

$\"user-pic\"$

Covertghost

@harknell: Could you not just create a script that auto-opts in the user though?

$\"user-pic\"$

KreativeHitman13

@Covertghost: not without violating the ToS that you agree to when developing an app.

$\"user-pic\"$

admiral_stabbin

This is all well and good, but I want to know who names their kid \"Storm8\"? It's askin' fer trouble!

1 replies

$\"user-pic\"$

KreativeHitman13

@admiral_stabbin: Who said anybodys child was named Storm8?

$\"user-pic\"$

B

Has Apple closed the backdoor that allowed this exploit to happen, though?

$\"user-pic\"$

jaket

Yeah, the guys at Storm8 sound kinda slimy, and probably deserved the lawsuit.

However, as a budding Android developer, I'm hoping that the \"sue the programmer\" meme doesn't take root.

I'm happy to spend a few hundred hours writing an app that might not *make* much money. But if there's even an outside chance that the app might *cost* me several thousand dollars in legal fees (and perhaps a bankruptcy-inducing judgment if the lawyer finds the jury's hot button), I think I'll find another hobby.

3 replies

$\"user-pic\"$

Rachacha

@jaket: Well the simple solution would be to not develop applications that scrape data from the user's phone and send it back to you (without their consent if the application is designed to do that for some reason).

Most free or paid applications at least on the iPhone are rather harmless. Worst case is that it might freeze your phone, and the user needs to restart or restore the phone. Other than a minor inconvenience, there were no damages and no violation of privacy, therefore, no grounds for a lawsuit (just in my personal opinion which is worthless as I am not a lawyer)

$\"user-pic\"$

Michael Belisle

@jaket: I too have no problem with \"sue the programmer\" when the reason for the suit is \"programmer is a slimeball.\"

I don't think it in anyway suggests that programmers in general are more likely to be sued. This is, after all, one developer out of tens of thousands on the App Store that got sued because he earned it.

Moral of the story? Don't be a dumbass and you shouldn't get sued.

$\"user-pic\"$

jaket

@Michael Belisle: I wish I could share your faith that frivolous lawsuits aren't common. And for tech issues, I have zero confidence that a jury couldn't easily be manipulated by a skilled lawyer. Were it so simple as \"don't be a dumbass.\"

$\"user-pic\"$

_NARC_

That's great, I had World War installed. Once this is certified I'll need to sign up as a claimant.

$\"user-pic\"$

pippenz

Que Fanboi's - Where did i put my black skinny jeans....

1 replies

$\"user-pic\"$

RogerTheAlien

@pippenz: \"Que fanbois\"? Ahhh, espanol. Una lengua bella. Pero, es posible que quisiera decir \"cue\"? O tal vez \"queue\"?

$\"user-pic\"$

LatherRinseRepeat

I think scammers are seeing the iphone as a viable source to rip people off. It's going to be a matter of time before they hack in each user's itunes accounts and starting plucking credit card numbers.

1 replies

$\"user-pic\"$

fantomesq

@LatherRinseRepeat: Doubtful. The iPhone doesn't have access to credit card info. The iPhone requests that a purchase be made and authenticates it. The credit card information only exists on Apple's servers.

$\"user-pic\"$

DaBull

I had previously downloaded the iMobsters app, and just deleted it from my phone after reading this post. Thanks for the heads up Consumerist!

It's surprising to learn that something like this is possible, espescially after Apple is supposed to \"review\" all apps before allowing them into the App Store.

I hope Storm8 gets what's coming to them.

1 replies

$\"user-pic\"$

RogerTheAlien

@DaBull: +1. I'm an admitted Apple fan, but not religiously so, and I think Apple's kind of screwed the pooch a couple of times with their \"review\" process. There're a lot of apps that are laden with bugs and rarely, if ever, work correctly; some are just inappropriate (the shaken baby app comes to mind), and then there's this whole ordeal. What, pray tell, does Apple's \"review\" process consist of, then? Apparently nothing, given what's out there. Still love my iPhone, MacBook Pro, etc, but WTF Apple? Get your head in the freakin' game!

$\"user-pic\"$

ninjatoddler

Another reason not to get an iPhone.

$\"user-pic\"$

baristabrawl

Their games do not seem cool to me. And this is not a reason not to get an iPhone. I don't play games on mine. I don't get why you would. But someone does, they're making a gazillion games for it.

Another reason not to get an iPhone. Funny. Because I read that as, \"I have sour grapes.\"

$\"user-pic\"$

nstonep

Nah...I doubt it's \"specialized software\"; probably just used for identification especially if they're using data from one user in multiple games. Not that it's right...just that it's highly dubious in and of itself that someone could claim it is \"nefarious\".

$\"user-pic\"$

Franknbeans

I am rather surprized this company did this in the first place, they had a good thing going there, revinue from several games that sold rather well. What possesed them to steal the numbers? Anyone in their right mind knows they will eventually get caught, then the gravy train is over.

November 18, 2009 4:52 PM

$\"user-pic\"$

Quazie

Its super easy to get an iPhone number via code. In the first version of a social network I was writing in college we gaurenteed uniqueness with the phone number, which we pulled off the iPhone without asking. We never released the project, and have since changed our way of ensuring users are unique, but there is no specialized code involved.

One line of code pulls the number, and they are already sending data back to their servers. It is certainly wrong of them to have done it, but it requires nothing custom or specialized.

$\"user-pic\"$

Chupageek

December 3, 2009 1:42 PM

\"There is no manner in which the iPhone can surreptitiously download, run and distribute an unapproved app so no threat of viruses... \"

I don't think you understand malware very well. It is true that I can't get a trojan by downloading and running arbitrary applications off of the web (as this article points out, you can still get a trojan, you just have to go through Apple to do so) that is by no means the only way malware propogates.

Vulnerabilities in a number of iPhone components can lead to arbitrary code execution - this is EXACTLY how iPhones are jail broken. However what is being exploited for argueably benign purposes (or at least purposes that the owner is cool with) can also be exploited for malicious purposes. The various Safari vulnerabilities could just as easily be used to execute email harvesters as they could for unlocking the phone. Safari isn't the only entry point - Apple is terrible about documenting what they actually patch in OS updates but if you read through them it is still possible to infer that the iPhone wifi drivers and bluetooth drivers have both had buffer overruns that could be used to execute arbitrary code (from a purely academic standpoint it would be interesting to watch the spread of iPhone viruses distributed this way via compromised airport access points, and then from iPhone to iPhone - I suspect it would almost perfectly mirror human pathogen models since it would be proximity based. Note, not advocating it, simply finding the idea interesting). Similarly, their media codecs are REGULARLY compromised - exploits against Quicktime is one of the leading causes of Windows malware propogation - and it is entirely possible to simply alter the exploit to target the iPhone with a malformed media file instead.

There is absolutely nothing about the iPhone design that makes it bullet proof to code execution vulnerabilities - quite the opposite when you look at the fact that most of the components share code with the desktop and also regularly have vulnerability advisories released against them.

$\"user-pic\"$

Chupageek

December 3, 2009 1:54 PM

And as a quick follow up:

\"An app could harvest data but it cant damage the phone itself.\"

The DATA is what is WORTH stealing - you realize that right? Corporate email, documents, etc have value and can be sold to someone - no one is interesting in renting time on a cell phone botnet or bricking phones just to be malicious. If someone is targetting a cell phone it is because they want they data on it, and this article is a great example of that.

It is, incidentally, why folks that point out that a layered permission model is some kind of security silver bullet and thus why linux/OS X are more secure are off base (and not just because the NT line of Windows has a similar permissions model). Malware produces revenue in two ways - taking data that can be stolen and renting computational time (for SPAM zombies, brute force attempts to break passwords or encryption keys, etc). The former generates by far the most money for malware, and generally the latter is used to get the former. The layered permissions model does nothing to protect a user's data, except from other users on the system. Anything executing as them has access to the same data they have access to. Data is the currency of the malware trade, so the fact that a user land iPhone exploit can \"only\" get data is really no comfort at all (and completely ignores the multitude of elevation of priviledge attacks possible to get root).