Apple Removes Scam App That Led to Hijacked Facebook Ad Accounts

[4743913]

a lot of apps people want but Apple will never allow, like Xbox Game Pass for Cloud.

this one also makes me mad and continues to illustrate that apple is only concerned with their greedy cut under the guise of "looking out for the safety of users"..

 

[ponzicoinbro]

no they weren't. the problem with these threads are some with an irrational fear of installing software. They run around with their straw man arguments, half truths and just general fear mongering.. We will soon be able to install software from outside of the AppStore as was ORIGINALLY intended for the iPhone. Some people are going to have to find another walled garden in which to stifle development.

Keep dreaming and being ignorant of the world you live in today. It’s not the same world Steve Jobs lived in.

We are in the middle of a cyber war. If you are defending the methods of the enemy then you’re helping them.

If cyber threats are targeting people on social media then they will also be on popular computer forums and encouraging users to support bad ideas that reduce their security.

Latest:

https://about.fb.com/wp-content/uploads/2022/08/Quarterly-Adversarial-Threat-Report-Q2-2022.pdf

Social engineering: Bitter relied on fictitious personas, posing as attractive young women, journalists or activists, across the internet to build trust with the people it targeted to trick them into clicking on malicious links or downloading malware. Rather than indiscriminately targeting people with phishing, this group typically invested time and effort in establishing connections with its targets through various channels, including email.

iOS application: Our most recent investigation found Bitter deploying a chat application for iOS that users could download via Apple’s Testflight service for developers to help them beta-test their new applications. This meant that hackers didn't need to rely on exploits to deliver custom malware to targets and could utilize official Apple services to distribute the app in an effort to make it appear more legitimate, as long as they convinced people to download Apple Testflight and tricked them into installing their chat application. We don’t have any visibility into whether this app contained malicious code and assess that it may have been used for further social engineering on an attacker-controlled chat medium. We reported our findings to Apple.

● Android malware: We found Bitter using a new custom Android malware family we named Dracarys. Notably, it used accessibility services, a feature in the Android operating system to assist users with disabilities, to automatically click through and grant the app certain permissions without the user having to do it. Bitter injected Dracarys into trojanized (non-official) versions of YouTube, Signal, Telegram, WhatsApp, and custom chat applications capable of accessing call logs, contacts, files, text messages, geolocation, device information, taking photos, enabling microphone, and installing apps. While the malware functionality is fairly standard, as of this writing, malware and its supporting infrastructure has not been detected by existing public anti-virus systems. It shows that Bitter has managed to reimplement common malicious functionality in a way that went undetected by the security community for some time.

 

[4743913]

Keep dreaming and being ignorant of the world you live in today. It’s not the same world Steve Jobs lived in.

I just proved you wrong. You going into the "Ackchyually" mode by copy pasting a wall of words that I didn't even read won't help your case. The fact that installing software on my iPhone bothers you so much will make it that much sweeter while I am doing it.

 

[webkit]

In the same vein, I don't understand how anyone calling out Apple's supposed lackadaisical approach to policing the App Store could think that we would be better off were the App Store to be abolished altogether, and we returned to the free-for-all nature of PCs.

Isn't this like saying - crime is still happening despite the country having a police force, so let's scrap the police force.

In the very least, the App Store lets me pay with iTunes, ensuring developers don't get my payment details. I am able to track and manage my subscriptions in one place. Apple is able to enforce policies like ATT and Sign In with Apple.

I don't think that most people who oppose Apple's walled garden or restrictions want to see the App Store go away. They simply want more options for acquiring apps and perhaps also want to force Apple to face more competition which could lead to an even better App Store and iOS. I think Apple has the ability and resources to still keep iOS as safe and secure as it is now especially for those that prefer to only use the App Store, don't want to sideload, etc. People need to have more confidence in Apple's capabilities here.

Even if/when Apple opens up iOS more, the App Store will very likely remain the most common way users gets apps. For those that want to use alternatives, at least the options and competition would be there.

 

[GeoStructural]

Soooo why didn’t Apple remove the fb app?

Because they didn’t do anything wrong, in fact, they alerted Apple about the scam and Apple did NOTHING. It took an article to be published for Apple to act, very typical of them.

It is also always a pleasure to remind you that the Facebook app used to come included in iOS, baked inside Settings and all, with your contacts being synced by default… Apple is very cynical these days but there is people who remember.

 

[boyarka]

that is a bit myopic. 1) scam apps are built to deceive aka scam, only do that by hiding nefarious intent. 2) App Store operators do not have criminal investigative powers, not judicial punitive powers, 3) after hiding intent to get certification - morphed into something else (yah everyone should have seen that, not criminal or anything), 4) after valid complain made or other evidence of problem an investigation ensues and app is removed (should apps be removed at first suggestion? that would be fun, I could report Facebook and twitter and they would have to be removed, or do we stick with valid reports followed with an investigation? 5) Once removed, can't get back on in same form aka removed.

Now how about passing laws to allow for criminal investigation and punishment? How about requiring bonding of App Store developers to create a re-imbursement fund for victims.

Seriously, everyone admits it is not perfect, but why are there so fewer problems than on Android (for the same fees)? Could it be that the single source App Store actually works? Don't get me wrong, I'm for lower fees and more security

TL;DR: fanboyism and whataboutism

 

[jollydogfellow]

We should be mad at the scammers, not Apple. It’s like being mad at the police because people still get murdered.

I rather have a store where 1.25M scam apps are being removed annually than no safeguards at all.

In case you haven't noticed, a lot of people are mad at the police and deem it a waste of taxpayer's money, so it's not that outlandish a notion 😉

As for me, I pay good money for Apple gear and give up the convenience of sideloading because Apple claims to do a proper job of reviewing apps.

That's the key point there, business wise.
If company X promises something reasonably realistic in trade for money, I demand satisfaction or money back.

If "a simple document editing app" turns into a "Facebook Ad Manager" and the app doesn't get re-reviewed, it's a gigantic red flag in itself, even bigger than not finding the the backdoor.

 

[jollydogfellow]

2) App Store operators do not have criminal investigative powers, not judicial punitive powers,

You might have heard of static analysis, decompilers, debuggers, abstract interpretation, network sniffers.
Ought to be enough to catch many things of this sort relatively quickly.

Of course they require an engineer doing the actual work, who will usually demand a paycheck.
If you can't afford to pay said paycheck, maybe don't promise that your walled garden is so "safe".

Especially if you not only don't do that, but don't even re-check apps after massive changes, including (ENORMOUS red flags) their name and required permissions (because I don't suppose the "simple document manager" app required Facebook access, and if it did, who the hell approved it).

 

[BipedalOS]

What happens to apps installed on our devices when an app gets removed like this?

Does it get removed? Do we get told we have a "bad" app installed?

I hope Apple can force remove malicious apps to be honest.

 

[BipedalOS]

You can get Malware and hacked even without side loading. Great job.

It happens. Not every system is perfect but I’d be willing to bet Apple has stopped thousands of apps from getting by.

I still prefer the walled garden. I also know better to download apps from unknown third parties until I’ve done my due diligence.

 

[BipedalOS]

Precisely this. Only 3% of all Android users sideload. So there's no harm in allowing choice for the enthusiants since there's a lot of apps people want but Apple will never allow, like Xbox Game Pass for Cloud.

If you want to sideload, get an Android.

I don’t get it. If you don’t like a platform, then switch.

I don’t like paying a lot of money for BMW so I don’t drive one. I don’t like Samsung appliances so I don’t buy them. I don’t like the humidity, so I don’t live in humid areas.

 

[Spaceboi Scaphandre]

If you want to sideload, get an Android.

I don’t get it. If you don’t like a platform, then switch.

I don’t like paying a lot of money for BMW so I don’t drive one. I don’t like Samsung appliances so I don’t buy them. I don’t like the humidity, so I don’t live in humid areas.

"I don't get it. Why are you criticizing my beloved fruit computer company? Just go to the other duopoly. The Mac should be able to install whatever but not the iPhone."

 

[Abazigal]

"I don't get it. Why are you criticizing my beloved fruit computer company? Just go to the other duopoly. The Mac should be able to install whatever but not the iPhone."

I personally would be fine with that Mac being as locked down as the iPhone (eg: only being able to access apps via the App Store), but I guess that rubicon has been crossed.

 

[Spaceboi Scaphandre]

I personally would be fine with that Mac being as locked down as the iPhone (eg: only being able to access apps via the App Store), but I guess that rubicon has been crossed.

Remember the iPad is locked down too and they're trying to market it as a laptop replacement. And yet despite having the guts of a Mac, it does less than a Mac and is more expensive than a Mac.

And optional sideloading has proven many times to be fine. Virtually every mobile device except the iPhone has it. Even the Quest 2 has sideloading. Hell, the Microsoft Xbox, an entire game console, has sideloading! And are any of these devices negatively impacted by it? No. Of course not.

So why should the Mac be able to freely install software without an app store but not our iPhones, especially with how expensive they've become? We paid for the phone. We deserve everything that is on that phone.

 

[Abazigal]

Remember the iPad is locked down too and they're trying to market it as a laptop replacement. And yet despite having the guts of a Mac, it does less than a Mac and is more expensive than a Mac.

And optional sideloading has proven many times to be fine. Virtually every mobile device except the iPhone has it. Even the Quest 2 has sideloading. Hell, the Microsoft Xbox, an entire game console, has sideloading! And are any of these devices negatively impacted by it? No. Of course not.

So why should the Mac be able to freely install software without an app store but not our iPhones, especially with how expensive they've become? We paid for the phone. We deserve everything that is on that phone.

I will argue that you are not so much paying for a phone, but the experience. And in this case, said experience comes from hardware, software and services working together, and part of it stems from the utility of a curated App Store. You don't hear anyone argue that certain speed limits should not apply to them because they are skilled drivers and can navigate 100 km/h without getting into accidents.

I also think you are confusing cause with effect.

The iPhone started with an App Store and users have never been able to side load apps. This means that in order to market their apps to users, developers had to go via the app store right from the very start. There has never been any other way. So Apple was able to start from a position of strength and has maintained that ever since.

It also doesn't help that the iPhone has a pretty significant market share, and users have proven that they are willing to spend. So developers go to where the users are, even if they have to jump through hoops to do so.

That the iPad does less than a Mac is a consequence of it running iOS, not so much because of the iOS App Store.

Conversely, the Mac has been akin to windows right from the start (eg: users installed their apps from external sources), with the App Store coming only way later. Apple could mandate that all apps had to go through the App Store, but at this point, developers are more likely to just abandon the macOS platform altogether than accede to these demands. Apple is likely aware that this is not a battle they can win.

Like I said, if I could have my way, I also wouldn't mind the Mac app store being more locked down like the iOS App Store, rather than the other way around. Not least for the benefit of being able to track and manage all my app downloads and updates all in one place.

 

[Shirasaki]

Like I said, if I could have my way, I also wouldn't mind the Mac app store being more locked down like the iOS App Store, rather than the other way around.

Which puzzles me to this day on why apple doesn’t mandate App Store on Mac OS on day 1 apple silicon release. Devs can’t do anything if they want to release apps on macOS platform outside of abandoning it anyways, as apple is way too big to fail. Yes, people will have few if any app on apple silicon early on, but it will be just another transition pain apple user has been accustomed to in the past. So no big deal happening again.

 

[hagar]

That's the key point there, business wise.
If company X promises something reasonably realistic in trade for money, I demand satisfaction or money back.

Glad you put the word reasonably in italic. Because Apple has to review many thousands of apps each day, they block 1.25M a year. The public and devs demand these reviews to be quick.

So the only conclusion is that the vast majority of apps have to be checked automatically. And only a very small percentage get additional manual checks.

So bad apps will unavoidably slip through.

 

[ponzicoinbro]

And optional sideloading has proven many times to be fine.

False and you are spreading misinformation.

When forum members refuse to answer the risks outlined below, people should suspect that such forum members are involved with these schemes.

https://about.fb.com/wp-content/uploads/2022/08/Quarterly-Adversarial-Threat-Report-Q2-2022.pdf

Social engineering: Bitter relied on fictitious personas, posing as attractive young women, journalists or activists, across the internet to build trust with the people it targeted to trick them into clicking on malicious links or downloading malware. Rather than indiscriminately targeting people with phishing, this group typically invested time and effort in establishing connections with its targets through various channels, including email.

iOS application: Our most recent investigation found Bitter deploying a chat application for iOS that users could download via Apple’s Testflight service for developers to help them beta-test their new applications. This meant that hackers didn't need to rely on exploits to deliver custom malware to targets and could utilize official Apple services to distribute the app in an effort to make it appear more legitimate, as long as they convinced people to download Apple Testflight and tricked them into installing their chat application. We don’t have any visibility into whether this app contained malicious code and assess that it may have been used for further social engineering on an attacker-controlled chat medium. We reported our findings to Apple.

Android malware: We found Bitter using a new custom Android malware family we named Dracarys. Notably, it used accessibility services, a feature in the Android operating system to assist users with disabilities, to automatically click through and grant the app certain permissions without the user having to do it. Bitter injected Dracarys into trojanized (non-official) versions of YouTube, Signal, Telegram, WhatsApp, and custom chat applications capable of accessing call logs, contacts, files, text messages, geolocation, device information, taking photos, enabling microphone, and installing apps. While the malware functionality is fairly standard, as of this writing, malware and its supporting infrastructure has not been detected by existing public anti-virus systems. It shows that Bitter has managed to reimplement common malicious functionality in a way that went undetected by the security community for some time.

A massively slippery slope to even call for sideloading.

Once that precedent is set, every nation and every local state may begin to force local citizens to download Store fronts containing apps developed by local governments.

So you’re in Russia (they already tried to make Apple do this), and you are forced to sideload voting apps and health apps that not only track who you voted for, but also your personal messages, photos, and sexual orientation.

So you’re in Uganda, and you are forced to sideload voting apps and health apps that not only track who you voted for, but also your sexual orientation. It is a life time prison sentence to be gay in Uganda.

So you’re in Texas, and you are forced to sideload voting apps and health apps that not only track who you voted for, but also if you are pregnant and what happened during your pregnancy.

Shall we continue down this slippery slope?

What makes YOU think you and all your lifestyle choices, personal data, hobbies and thoughts will be safe?

If anyone really think they are safe from smart devices being hijacked and there’s no problem….they are either a completely demented fascist or a lonely loser who just wants everyone else to suffer.

Nobody should doubt for a moment that popular forums like this are not being targeted with disinformation campaigns and by political actors/troll farms. It’s everywhere, on forums, social media, in youtube comments, etc. Dictators and criminal gangs want completely access to your devices.

 

[polyphenol]

And optional sideloading has proven many times to be fine.

You'd have to download and check every app to prove sideloading is fine.

Just one bad app would undermine that attempt at proof.

At best, in the real world, we can possibly hope to prove that some sideloading is fine.

By the same token, any bad app from the app store undermines our faith in that. Rightly.

But action to remove such apps is possible. Apple deserve criticism if they were tardy or didn't take it seriously.

Perhaps some relatively independent oversight would help all round? For example, even a panel which checks on numbers of reports, actions taken, and time it took. And make that public.

 

[vahdyx]

We should be mad at the scammers, not Apple. It’s like being mad at the police because people still get murdered.

I rather have a store where 1.25M scam apps are being removed annually than no safeguards at all.

I disagree, I would say you should be mad at both especially Apple.

As others have said Apples messaging makes it seem like everything on the App Store is safe.

A better analogy than yours is, Apple is an all you can eat buffet and they say, “Enjoy, everything has been prepared with our highest standards, you just eat anything in front of you!” Then suddenly you get sick from the shrimp that wasn’t handled well.

Sure you can blame the shrimp or the fisherman, or the truck drivers, or the pollution in the waters, or the earth’s roatation, or Bob, but at the end of the day Apple put it in front of you without thoroughly checking it! So being mad at Apple IMO isn’t unwarranted!

 

[DD88]

Pretty much, less clever, less skilled people can just go and get lost.

Forgetting, or simply ignoring, that many people are forced to use the internet. For example, there are government services which are only available on the internet. Getting prescriptions issued more or less requires internet use. There are many goods which are unobtainable except over the internet.

Might not be like that in your area. But it is for me, and millions of others, in mine.

Not sure where you are from but in the UK nobody needs the internet for prescriptions. That’s why you go to the doctor and he gives you the prescription to hand it in to the pharmacy and they sort your prescription for you. Yeah you can sort prescriptions online but it’s never recommended as a lot of people get sent the wrong things or have tablets stolen. My mum when she ordered some had some thyroid tablets and half were missing and they sent her some paracetamol for no reason whatsoever….

 

[DD88]

no they weren't. the problem with these threads are some with an irrational fear of installing software. They run around with their straw man arguments, half truths and just general fear mongering.. We will soon be able to install software from outside of the AppStore as was ORIGINALLY intended for the iPhone. Some people are going to have to find another walled garden in which to stifle development.


View attachment 2039676

Tell that to my mate who downloaded Google chrome on his old microsoft laptop from the Google website itself and his computer got infested with spyware, Trojan’s and porn.

 

[vahdyx]

If you want to sideload, get an Android.

I don’t get it. If you don’t like a platform, then switch.

I don’t like paying a lot of money for BMW so I don’t drive one. I don’t like Samsung appliances so I don’t buy them. I don’t like the humidity, so I don’t live in humid areas.

You’re preaching about choice, yet Apple doesn’t give you that choice! What’s wrong with Apple giving you a choice.

Also BMW makes cars that are less expensive for people that don’t wanna pay a lot. So BMW gives you a choice! There’s KIAs more expensive than some BMWs

Samsung isn’t just one of two options. If you had to buy Samsung or GE and that’s it, then maybe you’d have a different view on it.

Again with the humidity, if you had Florida as one option or Alaska as the other and that’s it what would you choose? You wouldn’t be like, “man it would be nice if Florida would give dehumidifiers to make some part of my live better?” This scenario only works assuming that you don’t have a choice on how to live in the humidity. But the general idea should be the same.

 

[polyphenol]

Not sure where you are from but in the UK nobody needs the internet for prescriptions. That’s why you go to the doctor and he gives you the prescription to hand it in to the pharmacy and they sort your prescription for you. Yeah you can sort prescriptions online but it’s never recommended as a lot of people get sent the wrong things or have tablets stolen. My mum when she ordered some had some thyroid tablets and half were missing and they sent her some paracetamol for no reason whatsoever….

At my (UK) surgery, using the internet is the normal, expected way of ordering repeat prescriptions.

One medicine I need is not handled as a repeat. For that, I have to email the GP surgery.

The surgery, the surgery's website, etc., all advise me not to visit the surgery without having an appointment.

I could phone but even that makes me listen to messages advising me to use the internet to order repeat prescriptions.

The old system of using the tear-off second page of a prescription to order a repeat is no longer possible for me - that page is either blank or used for other purposes.

Many people are in areas where prescriptions are electronic only. They are transmitted directly to the pharmacy for dispensing without being printed at all.

I still go to collect my prescribed medicines from a physical pharmacy. Your comment about tablets being stolen suggests you are referring to fully online pharmacies with some sort of delivery (e.g. by post). When the person behind the counter hands them over, I positively check exactly what is in the bag - the medicines, the makes, the doses, the numbers, the expiry dates - before I move away from the counter. Thus, if there is any issue, it can be addressed there and then.

I am also expected to request appointments online.

 

[4743913]

Tell that to my mate who downloaded Google chrome on his old microsoft laptop from the Google website itself and his computer got infested with spyware, Trojan’s and porn.

obviously sorcery...