Apple's Ability to Deactivate Malicious App Store Apps

[ictiosapiens]

I think the important issue here is apple's concept of malicious...

Personally I'd prefer it if apple sent me an email if I bought an app that is now considered "malicious" and then I can make a decision of wether to delete it or not...

I suppose that if the app was actually interefering with the network, or messing with third parties it would be a different story... Hopefully this will fit into apple's concept of "malicious"

 

[JCC]

What I find amusing is that simultaneous to this, the folks at TUAW are complaining that Apple should have free trials of non-free apps. That is, allow you to use it for some period of time, then remotely deactivating it if you don't pay for it within that period. (I don't know how else this could work since the monetary transaction has to happen through the App Store.) I'm not sure what's wrong with the current system of a free "Lite" app, but there you are.

On one hand, you have people begging for some use of remote deactivation. On the other hand, you have people up in arms because someone found a file called "unauthorizedApps", although no one knows for sure why the file exists, what it's used for, or if Apple will ever use it for anything. The uproar is over the speculation that perhaps a remote deactivation mechanism might exist, never mind what it might be used for.

(Yes, the former is deactivating on one iPhone and the latter is deactivating on all iPhones. However, both cases give Apple a lot of control over what is on any given iPhone. It's hard to allow the former without also allowing the latter.)

No wonder that no matter what Apple does, there will be both a healthy outcry for it and against it.

[Why would you stick this inside CoreLocation? It makes more sense to me to speculate that this is a list of apps unauthorized to use CoreLocation.]

 

[RedTomato]

The N95 blows the iPhone way outa the water in terms of specifications. Yes, the iphone interface is cool. Yes, the touch system is appealing. But paying twice as much for a phone with half the features is not appealing no matter how cool the touchscreen is.

Most people I know with phones like that don't use even a quarter of the features on them (for various reasons). I have a lovely HTC TyTn (T-Mobile Vario II) and I'm pretty skilled at using it, but even I shrink from using it to its full extent as the OS is just too damn clumsy (and I'm a technical officer at a small corp).

I would be willing to bet that most people with the iPhone use more individual features than people with the N95 , N97, HTC xx etc.

500 features ain't no good if you don't use them.

 

[antel0pe]

I'm confused how are you guys happy that Apple can essentially assert executive control over your or my iPhone or iPod Touch? I don't like all this necessary evil stuff you are raising, beyond closing down potentially malicious applications all I see is another vector for attacks against this platform and for abuse on the side of Apple. Not to mention that calling home is widely seen by all as something that should be fully and completely disclosed to users, irregardless of the intentions on the part of Apple or for that matter any other manufacturer.

As I recall Adobe was recently slammed by the tech media for including code that called home, while it turned out to be rather innocuous, it still raised huge questions that ended in Adobe removing the code. Apple has a responsibility to its users to tell them when their software is calling home, rather than hiding it deep in application directories. But beyond this they should be offering options to turn it off, irregardless of the positive or negative effects of doing so.

Adobe's, and thousands of other apps, have been phoning home for years. What adobe was doing recently was writing to sectors of the drive that are off limits. This was causing all kinds of problems.

Phoning home isn't the issue here it's the remote removal ability. In all honesty I don't forsee apple using this to remove an app like NetShare. The possibility of abuse by an external party who was able to modify the file is a bigger issue to me, thought even that would be easy enought for Apple to recover from.

 

[newb16]

I own the iPhone. Not them.

You own hardware only. Do they have right to terminate your iPhone OS license at any time and render it unusable remotely ( CYA-ed with fine print 'no warranty expressed or implied' somewhere in eula) ? I don't know, read the fine print.

 

[clevin]

hard to imagine some users are submissive to this degree, its a blatant invasion of your freedom. Its just stupid.

 

[marksman]

I thought they should have kept "I am Rich" in the app store. I don't think they need to start passing judgement over quality. Just make sure it doesn't crash, cause problems, or break their rules.

I suspect NetShare and BoxOffice removals were on some technicality and will return, though they need to tell developers when they pull their apps.

arn

I agree with this 100%. I don't want Apple making judgment calls for what should be in the store.

If there can be 25 applications that are a BLANK screen (ie flashlights), sure as heck can have one that is a picture of a diamond.

Perhaps he could re-submit his application as the most expensive flashlight in the world and have a diamond in the middle of the blank white screen.

 

[retroneo]

AT&T doesn't allow tethering on the iPhone, Apple has to enforce it.

AT&T is just one of the thirty-odd carriers currently offer the iPhone. Tethering is encouraged by all three carriers offering the iPhone here in Australia.

 

[bigmc6000]

Does anybody know why BoxOffice was removed? I downloaded it early on and never even thought a thing about it - I had noticed that while more than 50% of my apps have had updates it didn't but I figured that was because it's a fairly simply app.

I'd say if Apple removed your ability to use an App that caused no harm to the iPhone OS (read: malicious) and did not give you a refund it would be a PR nightmare from hell that every single newspaper, IT journal and every competitor would leach on to and say "see, this is why you don't want a single source provider - they'll screw you whenever they d@mn well feel like it."

 

[jashic]

Whats the big deal guys? If your iphone has nothing wrong with it, then there's nothing wrong with Apple looking into your phone once in a while. Just like, if you have nothing to hide at home, you should have no problems with a random house search by police every 1-2 months. Right?

 

[Baron58]

There is no store on earth (well there could be but I can't think of any) that can take a product back from you once they have sold it to you. That is an important distinction that you are quite obviously missing.

I own the iPhone. Not them. If I want to put a frikkin app on there that I paid for, or is free, that's my business, not there's.

You don't own ANY software. You don't own OS X, Windows, Word, Excel, Powerpoint, Firefox, OpenOffice, Photoshop.... NOTHING. Whether it's paid or free, proprietary/closed or open-source, or public domain. Unless YOU wrote it, you DON'T own it. You are granted a licence to use it under the terms that the owner (not you) allow, and they may revoke that licence at any time. No, a store can't come into your house and 'steal' something that you purchased and own. Apple (or Microsoft, or Adobe, or whomever) CAN revoke your licence to use their software. It is not 'stealing', since it wasn't yours to begin with.

You may think you own the iPhone hardware that you purchased, but if you received an AT&T subsidy you don't actually 'own' it until the term of your service contract has been completed. You don't own the OS on the phone, the apps on the phone, the phone service, or anything else. If you paid full price for it you own at the most some plastic/glass/silicon/metal parts.

So, like was posted earlier, if you don't like it you can build your own phone hardware, write your own phone OS and apps, and do whatever you like with it.

 

[pddemetar]

Isn't it more likely a Core Location blacklist?

Isn't it more likely that this is a blacklist for Core Location? They don't want apps hammering their location services. The url makes sense too: "clbl". Core Location BlackList.

 

[bigmc6000]

AT&T is just one of the thirty-odd carriers currently offer the iPhone. Tethering is encouraged by all three carriers offering the iPhone here in Australia.

Also, I don't think AT&T is too happy about people being able to send text messages via AIM but that doesn't mean Apple has to enforce it. The studios don't want you to be able to create your own ringtones but Apple hasn't stopped you from doing the very simple action of just copying and renaming the song ".m4r"...

Apple is on a slippery slope in terms of appeasing both the consumer and the provider and I certainly hope they don't fall to either one side as the other side would become VERY pissed.

 

[Stella]

These antics by Apple show just how insecure and immature the iPhone platform is. Other smartphones have security models that make it hard for developers to create malicious applications. How do they do this? Security Certificates. The very basic certificates are free and self signed - for example, with this, the user needs to give the application permission to access the internet.

Apple should implement this type of security model soon and Apple won't have to create blacklists, application approvals and other 1984 type measures.

 

[arn]

These antics by Apple show just how insecure and immature the iPhone platform is. Other smartphones have security models that make it hard for developers to create malicious applications. How do they do this? Security Certificates. The very basic certificates are free and self signed - for example, with this, the user needs to give the application permission to access the internet.

Apple should implement this type of security model soon and Apple won't have to create blacklists, application approvals and other 1984 type measures.

I don't see how this would help.

So if I give permission for an app to access the internet to get movie times, but it actually sends personal information to a spam provider, how does this help me?

A malicious App isn't going to ask my permission to perform malicious activities.

arn

 

[arn]

hard to imagine some users are submissive to this degree, its a blatant invasion of your freedom. Its just stupid.

I don't understand how this is an invasion of anything?

Just because Apple is capable of doing something doesn't mean the worst case scenario will occur.

1. Apple could deauthorize all of your iTunes music today if it wanted to.
2. Apple could deauthorize EVERYONE's iTunes music today if it wanted to.
3. Apple could send out a software update to everyone's iPhone that bricks them all.
4. Apple could send a Mac OS X update to package up all your email addreses from your Mac and send them to the highest bidder.
5. Apple could deactivate an app on your iPhone for no good reason at all.

Just because Apple could do something doesn't mean they will. Why aren't you outraged and complaining about #1-#4?

arn

 

[JML42691]

I don't understand how this is an invasion of anything?

Just because Apple is capable of doing something doesn't mean the worst case scenario will occur.

1. Apple could deauthorize all of your iTunes music today if it wanted to.
2. Apple could deauthorize EVERYONE's iTunes music today if it wanted to.
3. Apple could send out a software update to everyone's iPhone that bricks them all.
4. Apple could send a Mac OS X update to package up all your email addreses from your Mac and send them to the highest bidder.
5. Apple could deactivate an app on your iPhone for no good reason at all.

Just because Apple could do something doesn't mean they will. Why aren't you outraged and complaining about #1-#4?

arn

I just don''t understand why some people don't understand that point. Do half the people that are posting how bad this is even know what malicious means? Nowhere in this article does it suggest that Apple would be using this to deactivate all apps removed from the App Store, just that they have the ability to, and that the ability is reserved for any apps that may cause harm to the device, or apps may invade your privacy. This is for your own good, I know that I would want Apple immediately shutting down an app that would be causing harm to my phone or invading my privacy.

And come on arn, use Edit or Multi-quote, haha, just joking.

 

[Stella]

I don't see how this would help.

So if I give permission for an app to access the internet to get movie times, but it actually sends personal information to a spam provider, how does this help me?

A malicious App isn't going to ask my permission to perform malicious activities.

arn

Your right, in the above scenario - it won't help you.

If Apple are going to crack down on iPhone applications, maybe they should do the same with OSX apps.

There is little difference between iPhone App and OSX app. Its an application running on an OS. It just 'seems' different because its a cell phone, when in fact, in reality - there is no difference.

 

[newb16]

Apple should treat iPhone restricted software like Mac software: No restrictions etc.

Or treat all iphone development like apple's internal development, like macos itself, and stop all this bs with "iphone developers' community". If they want new apps for iphone, they can hire iphone developers and sell result of their labor under any terms they want.

 

[TheZimm]

I wonder if they would just disapear or you'd get a message like, apple doesnt allow this app anymore

 

[Archie-]

I just don''t understand why some people don't understand that point. Do half the people that are posting how bad this is even know what malicious means? Nowhere in this article does it suggest that Apple would be using this to deactivate all apps removed from the App Store, just that they have the ability to, and that the ability is reserved for any apps that may cause harm to the device, or apps may invade your privacy. This is for your own good, I know that I would want Apple immediately shutting down an app that would be causing harm to my phone or invading my privacy.

You dont know what Apple may decide is currently "malicious". Most people here seem to agree that any app which works against Apple's interest is malicious even if it was of advantage to the user. Thats just sick.

What if some-one slipped an app into the app store that was a music player, but also (unnoticed by the very lax app store quality checkers) also allowed you to buy music from amazon for $0.20 cheaper? It seems most people in the thread here would just be too happy to rubber-stamp Apple's decision to pull and bar the app, just like pulled Netshare.

Apple's high-handed approach would be fine if there was another source of apps, but as millions would be solely dependent on Apple's teat, they should be more open to explaining their actions.

The short of it is that the user and Apple's interest do not always align, and being so fully at the mercy of Apple is only tolerable to sheep.

 

[arn]

What if some-one slipped an app into the app store that was a music player, but also (unnoticed by the very lax app store quality checkers) also allowed you to buy music from amazon for $0.20 cheaper? It seems most people in the thread here would just be too happy to rubber-stamp Apple's decision to pull and bar the app, just like pulled Netshare.

Here's where the argument breaks down. Apple didn't do this to Netshare. Apple has backlisted exactly 0 applications.

arn

 

[Stella]

Here's where the argument breaks down. Apple didn't do this to Netshare. Apple has backlisted exactly 0 applications.

arn

Time will tell. The store has been around for only a short period of time.

However, Apple did remove Netshare... I hope their reasons were good, and not just to satisfy AT&T ( and thus applying AT&Ts rules to the rest of the world ).

 

[bigmc6000]

Here's where the argument breaks down. Apple didn't do this to Netshare. Apple has backlisted exactly 0 applications.

arn

I think that's where people are making the leap from blacklisting malicious apps to blacklisting apps like NetShare or BoxOffice just because they aren't in the store anymore. Apple just has this to blacklist malicious apps and keep you safe from malicious code that may end up making it through.

Of course if they blacklist NetShare and BoxOffice (for whatever reason) I'll be the first to admit I was wrong and I'm sure arn will as well it's just so very, very unlikely I'm willing to take that risk.

 

[pacohaas]

What if some-one slipped an app into the app store that was a music player, but also (unnoticed by the very lax app store quality checkers) also allowed you to buy music from amazon for $0.20 cheaper?

That's a great idea!...especially if it allowed you to purchase music over 3G and not just WiFi like the iTunes Store app. And if Shazam added support for it, that would be the icing on the cake.