updated 06:15 am EDT, Mon August 19, 2013
More questions raised about Apple app approval process
The security of Apple's App Store approval process has had its credibility challenged following revelations that it approved an app that was submitted by researchers with remotely assembled malware hidden in its code. According to Technology Review, the team from Georgia Tech monitored the app throughout the approval process and found that Apple only ran the app for a few seconds before approving it. This did give Apple the time to detect the malicious code which subsequently assembled into malware that could steal personal information, device IDs, photos as well as send texts and emails.
"The app did a phone-home when it was installed, asking for commands. This gave us the ability to generate new behavior of the logic of that app which was nonexistent when it was installed," said Long Lu, a member of the team at Georgia Tech, led by Tielei Wang. "The message we want to deliver is that right now, the Apple review process is mostly doing a static analysis of the app, which we say is not sufficient because dynamically generated logic cannot be very easily seen," Lu asserted.
In May this year one of our editors, Sanjiv Sathiah, reported discovering two fake apps that had slipped through Apple's app approval process. Apple removed the apps upon being notified of their existence. At the time, MacNN contacted Apple regarding the two fake apps and spoke to Apple spokesperson Jesse James. James was not prepared to comment on how the apps were able to slip through Apple's app approval process, but was only prepared to state that the "Apple App Store is the only curated app store in the world."