Register FAQ / Rules Forum Spy Search Today's Posts Mark Forums Read
Go Back   MacRumors Forums > News and Article Discussion > iOS Blog Discussion

Reply
 
Thread Tools Search this Thread Display Modes
Old Mar 20, 2014, 11:32 AM   #1
MacRumors
macrumors bot
 
Join Date: Apr 2001
Malicious Tor Browser Persists in iOS App Store for Months Despite Protests




Developers working on the Tor anonymity service asked Apple months ago to remove a malicious Tor browser that poses a threat to its users from the App Store (via Ars Technica). After receiving no action through official channels, Tor project members now are using more public means to get this app removed.

A report ticket published three months ago by volunteer Phobos details the issue with rogue app.
Quote:
"Tor Browser in the Apple App Store is fake. It's full of adware and spyware. Two users have called to complain. We should have it removed."
Tor officials confirmed they filed a complaint with Apple in December 2013 and received a response that the app developer was allowed to defend his app from these accusations.

Several followup emails were sent to Apple, but there was no response from the Cupertino company. Twelve weeks later and the app remains in the App Store, prompting the team to step up their campaign to get the app removed.
Quote:
"I think naming and shaming is now in order. Apple has been putting users at risk for months now," writes lunar

"I mailed Window Snyder and Jon Callas to see if they can get us past the bureaucracy.

Otherwise I guess plan C is to get high-profile people on Twitter to ask Apple why it likes harming people who care about privacy. (I hope plan B works.)," writes arma.
Apple's App Store is known for being a walled garden where apps are vetted before they are allowed entry into the App Store. The process is not flawless, though, with researchers from Georgia Tech last year showing how an innocuous app with hidden malware-type code could slip through Apple's app approval system.

Once a malicious app is identified in the App Store, Apple has in the past taken steps to remove the app, but the exact process by which an app is removed is not known. In an earlier example, Apple quickly pulled a Russian SMS app that quietly scraped address book contacts and sent them to the developer's server.

Update 8:26 PM: Tor Browser has been removed from the App Store.

Article Link: Malicious Tor Browser Persists in iOS App Store for Months Despite Protests
MacRumors is offline   0 Reply With Quote
Old Mar 20, 2014, 11:34 AM   #2
needfx
macrumors 68000
 
needfx's Avatar
 
Join Date: Aug 2010
Location: macrumors apparently
self immolations should do the trick
needfx is online now   1 Reply With Quote
Old Mar 20, 2014, 11:47 AM   #3
ouimetnick
macrumors 68020
 
ouimetnick's Avatar
 
Join Date: Aug 2008
Location: Beverly, Massachusetts
Send a message via AIM to ouimetnick Send a message via Yahoo to ouimetnick Send a message via Skype™ to ouimetnick
I'm surprised the NSA doesn't force Apple to remove and ban those type of applications.
__________________
ACMT
MacBook Pro 13" (Mid 2010) 2.4GHz C2D, 4GB RAM, 750GB HD; Mac Pro Mid 2007; various MacBooks; Power Mac G5; iPhone 4s; iPhone 5s

Last edited by ouimetnick; Mar 20, 2014 at 03:55 PM.
ouimetnick is offline   0 Reply With Quote
Old Mar 20, 2014, 11:53 AM   #4
rageguy
macrumors member
 
Join Date: Jun 2009
I am unable to find out what is so malicious about this fake Tor app. I don't see evidence of malware. All I see is people wanting this fake Tor app to be removed because the name and logo are the same.

In other words, the original complaint "Tor Browser in the Apple App Store is fake. It's full of adware and spyware. Two users have called to complain. We should have it removed." appears to be false accusations.

Since no evidence has been presented, Apple of course will not remove the app. "Two users have called to complain" is not evidence.
rageguy is offline   5 Reply With Quote
Old Mar 20, 2014, 12:05 PM   #5
octothorpe8
macrumors regular
 
Join Date: Feb 2014
Maybe they're leaving it up there to poison the name "Tor" so people think it's generally unsafe.
octothorpe8 is offline   6 Reply With Quote
Old Mar 20, 2014, 12:30 PM   #6
subsonix
macrumors 68030
 
Join Date: Feb 2008
Quote:
Originally Posted by rageguy View Post
All I see is people wanting this fake Tor app to be removed because the name and logo are the same.
Perhaps it's not so smart to license the logo and trademark under creative commons if you want to control it.
subsonix is offline   8 Reply With Quote
Old Mar 20, 2014, 12:38 PM   #7
Parasprite
macrumors 65816
 
Parasprite's Avatar
 
Join Date: Mar 2013
Quote:
Originally Posted by subsonix View Post
Perhaps it's not so smart to license the logo and trademark under creative commons if you want to control it.
IIRC the license requires you attribute their work and not claim or imply that you represent them in any way, making this somewhat of a null point.
__________________
Has anyone, anywhere, ever actually used ~/Pictures/iPod Photo Cache/ for anything besides deleting or hiding it?
Parasprite is offline   3 Reply With Quote
Old Mar 20, 2014, 12:46 PM   #8
subsonix
macrumors 68030
 
Join Date: Feb 2008
Quote:
Originally Posted by Parasprite View Post
IIRC the license requires you attribute their work and not claim or imply that you represent them in any way, making this somewhat of a null point.
You don't need to recall, it's easy enough to google.

https://creativecommons.org/licenses/by/3.0/us/

I'm no lawyer, but the terms surrounding it apart from attribution seems pretty loose. On the other hand, allowing people to use your trademark seems like pretty obvious attack vector for a project like Tor, where trust is likely considered important. So why not use a strict license, or not allow sharing of the trademark at all. That way you would know if Tor=Tor so to speak.
subsonix is offline   0 Reply With Quote
Old Mar 20, 2014, 02:15 PM   #9
Parasprite
macrumors 65816
 
Parasprite's Avatar
 
Join Date: Mar 2013
Quote:
Originally Posted by subsonix View Post
You don't need to recall, it's easy enough to google.

https://creativecommons.org/licenses/by/3.0/us/

I'm no lawyer, but the terms surrounding it apart from attribution seems pretty loose. On the other hand, allowing people to use your trademark seems like pretty obvious attack vector for a project like Tor, where trust is likely considered important. So why not use a strict license, or not allow sharing of the trademark at all. That way you would know if Tor=Tor so to speak.
Did you read the license or just the summary? Because it seems pretty straight-forward (at least to me) with what is and isn't allowable under the license.

Quote:
You may not implicitly or explicitly assert or imply any connection with, sponsorship or endorsement by the Original Author, Licensor and/or Attribution Parties, as appropriate, of You or Your use of the Work, without the separate, express prior written permission of the Original Author, Licensor and/or Attribution Parties.
__________________
Has anyone, anywhere, ever actually used ~/Pictures/iPod Photo Cache/ for anything besides deleting or hiding it?
Parasprite is offline   2 Reply With Quote
Old Mar 20, 2014, 02:45 PM   #10
subsonix
macrumors 68030
 
Join Date: Feb 2008
Quote:
Originally Posted by Parasprite View Post
Did you read the license or just the summary? Because it seems pretty straight-forward (at least to me) with what is and isn't allowable under the license.
Only the summary actually, which states nothing but the attribution as a condition. Which imho wouldn't make any difference to determine if it was real or not. Then they should have no problem having it removed. Still don't get the point of the license in this case, what's the purpose of letting someone except the official project use it. And how could it ever be used without even implicitly imply connection with the project?
subsonix is offline   0 Reply With Quote
Old Mar 20, 2014, 03:55 PM   #11
Parasprite
macrumors 65816
 
Parasprite's Avatar
 
Join Date: Mar 2013
Quote:
Originally Posted by subsonix View Post
Still don't get the point of the license in this case, what's the purpose of letting someone except the official project use it. And how could it ever be used without even implicitly imply connection with the project?
Derivative works. I can't imagine there would be much of a need for The Tor Project to make, for instance, a version for use on Symbian OS, but if someone was motivated enough they probably wouldn't mind allowing use of the terms or logo as long as there isn't any confusion as to who it comes from.

A made up example of something they would have no problem with:

Quote:
Anonymity Browser for Symbian OS
[icon that looks like Earth+a picture of an onion]

This browser is based on software from The Tor Project [resized 16x16px Tor logo added next to text for visual clarity] to which we are not affiliated.
[disclaimer of liability]
To put it another way, they would gain nothing from getting the following removed:

Quote:
Onion Browser on the App Store (own name)
[Icon that doesn't even contain an onion]
Onion Browser support(->link to developer's website for support pertinent to the app)
[Statement that it relies on other projects, such as the Tor Project]
While in this case, there are several places implying it is part of the official project, and even links to torproject.org as the official place to go for support:

Quote:
Tor Browser on the App Store (official project name in title)
[icon that contains official onion logo, basically unedited]
Tor Browser support(->link to the Tor Project's main website, with nothing specific to the app in sight, no iOS app even mentioned in support)
[Brief description of what the browser does] (interestingly enough, it is almost verbatim to one found on the website since Orbot, another Tor-related project released sometime in 2008)
[No disclaimer]
[No statement of not being affiliated]
__________________
Has anyone, anywhere, ever actually used ~/Pictures/iPod Photo Cache/ for anything besides deleting or hiding it?
Parasprite is offline   0 Reply With Quote
Old Mar 20, 2014, 04:09 PM   #12
subsonix
macrumors 68030
 
Join Date: Feb 2008
Quote:
Originally Posted by Parasprite View Post
Derivative works. I can't imagine there would be much of a need for The Tor Project to make, for instance, a version for use on Symbian OS, but if someone was motivated enough they probably wouldn't mind allowing use of the terms or logo as long as there isn't any confusion as to who it comes from.

A made up example of something they would have no problem with:
Derivative works of the logo and trademark is pretty much pointless in this case and shows that priorities are wrong, what is this, an art project? Most likely the license got added without much thinking behind it, because it only applies to the trademark and logo.

The actual code is GNU licensed, it's stricter, it's where derivative work has any value in this case.



Quote:
Originally Posted by Parasprite View Post
To put it another way, they would gain nothing from getting the following removed:
They wouldn't need to because the Tor project is free software using the GNU license. We are talking strictly about the trademark and logo. How can you use an official logotype and trademark without even implicitly imply any connection with the project? It's pretty much the sole purpose of a logotype and trademark. My point is it leaves open an uneccessary wiggle room for what's implied and so on, when they could simply keep the trademark and logo for the official project only. That way there is never any doubt that the logo and trademark means the official project.
subsonix is offline   0 Reply With Quote
Old Mar 20, 2014, 05:16 PM   #13
Bathplug
macrumors 6502a
 
Join Date: Jul 2010
For tor browsers. I think the onion browser app is the best one?
Bathplug is offline   0 Reply With Quote
Old Mar 20, 2014, 09:09 PM   #14
Seņor
macrumors 6502
 
Join Date: Jun 2013
Location: United States
We don't need these third-party browsers in the first place.

They're not needed, practically bad in every way possible, and can prevent things like this from happening.

Time to put your foot down, Apple. There's no way people use third-party browsers in favor of Safari, or Google Chrome.

And if Apple wasn't so picky, they could have allowed Flash and Java on iOS, something that would destroy these eyesores right in their place.
__________________
rMini | Airport Extreme | MacBook Pro | iPhone 5

Write the code, change the world.
Seņor is offline   0 Reply With Quote
Old Mar 20, 2014, 09:15 PM   #15
C DM
macrumors G3
 
Join Date: Oct 2011
Quote:
Originally Posted by Seņor View Post
We don't need these third-party browsers in the first place.

They're not needed, practically bad in every way possible, and can prevent things like this from happening.

Time to put your foot down, Apple. There's no way people use third-party browsers in favor of Safari, or Google Chrome.

And if Apple wasn't so picky, they could have allowed Flash and Java on iOS, something that would destroy these eyesores right in their place.
Flash and Java in the browser isn't safe or all that optimized on a full computer, you certainly don't want that in a mobile browser.

As for third party browsers, well it seems Google Chrome is one that even you mentioned is fine, and there are some others that people use for one reason or another.
C DM is offline   0 Reply With Quote
Old Mar 20, 2014, 09:24 PM   #16
Seņor
macrumors 6502
 
Join Date: Jun 2013
Location: United States
Quote:
Originally Posted by C DM View Post
Flash and Java in the browser isn't safe or all that optimized on a full computer, you certainly don't want that in a mobile browser.

As for third party browsers, well it seems Google Chrome is one that even you mentioned is fine, and there are some others that people use for one reason or another.
I only included Java and Flash because the internet still doesn't want to rid them.

I want to say people don't still use them, but that is far from the case. It's dying out, sure. But it won't be gone until at least 2016 if humans still retain the same stupidity level.
__________________
rMini | Airport Extreme | MacBook Pro | iPhone 5

Write the code, change the world.
Seņor is offline   0 Reply With Quote
Old Mar 20, 2014, 09:56 PM   #17
ugcop
macrumors Demi-God
 
ugcop's Avatar
 
Join Date: Mar 2012
Location: Traveling @ Warp Speed ...... USA
No longer at App Store. Goodbye...
ugcop is offline   0 Reply With Quote
Old Mar 21, 2014, 11:17 AM   #18
Bathplug
macrumors 6502a
 
Join Date: Jul 2010
Quote:
Originally Posted by Seņor View Post
We don't need these third-party browsers in the first place.

They're not needed, practically bad in every way possible, and can prevent things like this from happening.

Time to put your foot down, Apple. There's no way people use third-party browsers in favor of Safari, or Google Chrome.

And if Apple wasn't so picky, they could have allowed Flash and Java on iOS, something that would destroy these eyesores right in their place.
Imo atomic, icab & mercury are all better than safari and chrome. Add browser changer and nitrous jailbreak tweaks and safari is the worst browser of the 4 mentioned.
Bathplug is offline   0 Reply With Quote
Old Mar 22, 2014, 12:05 PM   #19
charlituna
macrumors 604
 
charlituna's Avatar
 
Join Date: Jun 2008
Location: Los Angeles, CA
Quote:
Originally Posted by rageguy View Post

In other words, the original complaint "Tor Browser in the Apple App Store is fake. It's full of adware and spyware. Two users have called to complain. We should have it removed." appears to be false accusations.
could be why Apple didn't remove it at first. .
charlituna is online now   0 Reply With Quote
Old Mar 22, 2014, 12:47 PM   #20
nigameash
macrumors 6502
 
Join Date: Dec 2008
Location: Space: The Final Frontier
Quote:
Originally Posted by Bathplug View Post
Imo atomic, icab & mercury are all better than safari and chrome. Add browser changer and nitrous jailbreak tweaks and safari is the worst browser of the 4 mentioned.
I wish atomic browser would get an update.
__________________
15" rMBP, 2.3 Ghz, 16GB RAM, 512GB flash storage
iPhone 5 White 64
Nexus 7 2013 32GB LTE
nigameash is offline   0 Reply With Quote
Old Mar 22, 2014, 11:05 PM   #21
jeremysteele
macrumors regular
 
Join Date: Jul 2011
Quote:
Originally Posted by Bathplug View Post
Imo atomic, icab & mercury are all better than safari and chrome. Add browser changer and nitrous jailbreak tweaks and safari is the worst browser of the 4 mentioned.
iCab still exists? Thought that disappeared years ago? Wow, where have I been? :
jeremysteele is online now   0 Reply With Quote

Reply
MacRumors Forums > News and Article Discussion > iOS Blog Discussion

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Similar Threads
thread Thread Starter Forum Replies Last Post
General: question about Tor browser in iPad leland.mac Jailbreaks and iOS Hacks 4 Feb 1, 2014 03:02 PM
iPhone: Tor Browser and Anonomous browsing Jakebrown Jailbreaks and iOS Hacks 7 Aug 28, 2013 12:03 PM
iOS 7 Beta 4 Contains Fix For Malicious Charger Hack MacRumors MacRumors.com News Discussion 52 Aug 11, 2013 02:06 PM
'Apple Store' iOS App Update Coming Tuesday with Free iTunes Store, App Store, and iBookstore Deals MacRumors MacRumors.com News Discussion 77 Jul 31, 2013 03:48 AM
Size of the Average iOS App Increased 16% in Six Months MacRumors MacRumors.com News Discussion 131 Oct 21, 2012 09:58 PM

Forum Jump

All times are GMT -5. The time now is 06:39 PM.

Mac Rumors | Mac | iPhone | iPhone Game Reviews | iPhone Apps

Mobile Version | Fixed | Fluid | Fluid HD
Copyright 2002-2013, MacRumors.com, LLC