Apple's Enterprise Developer Program Also Being Used to Distribute Hacked Apps

[noraa]

Yes because bad people play by the rules. LOL

Ya because there’s NEVER been any nefarious apps slip through the screeners and make it onto the App Store. LOL

Security isn't (and never will be) perfect... LOL?

 

[DragonSky]

I didn't read the linked article, but how are developer certificates used to share applications with general users who aren't in the developer program?

And does the article really imply that people are not paying the devs via the app store, but paying some random dude for apps? And angry birds and spotify? Do these "pirated" apps bypass IAPs and subscription charges somehow?

Those questions will be answered when you read the article.

 

[simply258]

I myself use a service but not to pirate apps. I have a dual-sim iPhone so I need WhatsApp for both numbers. Whatsapp only have 1 app on the store and it doesn't support more than 1 numbers, so this way I can download a duplicate Whatsapp app to run the second number.

 

[Bayshun]

This started with Facebook getting caught doing some shady ****. Facebook screwed us again.

 

[rmariboe]

You don't need to enrol a phone; theoretically anyone can install an enterprise-signed app on any phone. I've tested this myself: I can install our in-house apps on my personal phone and nothing stops it.

“Enrolling” the phone is just Apple lingo for installing the Ent. Dev. Cert. public key, which is required to decipher the apps that are signed by the corresponding private key of said cert.

 

[gnasher729]

In other words, Apple wants to close loopholes to bypass Apple App Store and services to guarantee their 30% cut even for legit apps like Kodi. This is equivalent to if Google was to reverse their current policy by removing legit apps like Kodi from Google Play Store then disabling side loading of apps.

Apple wants Enterprise accounts, where a company signed a contract that they are only using it to distribute apps within their company, to be used only to distribute apps within the company. You seem to be absolutely desperate to paint anything Apple related in the worst possible light. Your problem is that everyone knows it, so you have absolutely zero credibility.
[doublepost=1550134641][/doublepost]

You don't need to enrol a phone; theoretically anyone can install an enterprise-signed app on any phone. I've tested this myself: I can install our in-house apps on my personal phone and nothing stops it.

Part of the contract is that your company must make sure that the app is only distributed within the enterprise. Now ownership of the phone is not essential, as long as you use it for work. Maybe your company has sent an email to every employee to only install this app for work purposes, and if you did it for private purposes, you may be in trouble with your company. And of course typical enterprise apps are _useless_ for anyone outside the company.

 

[TheFluffyDuck]

Are there any enterprises left that can trust apple? I mean their arbitrary release dates for machines cant be good for business. For instance there is 19 days till Apple over takes Microsoft in delay of an important product. 1902 days between XP and Vista, 1883 days between last Mac Pro and today. To say nothing of delays in other mac lines.

If I was an enterprise I wouldnt trust Apple anymore.

 

[himanshumodi]

They aren't developer certificates. They are Enterprise Distribution Certificates.

They are meant for companies to distribute apps for internal use through their own "app store".

Such apps are not vetted by Apple. They aren't distributed in the App Store.

They share them the same way that companies with internal apps share them within their companies. The devices have to be "enrolled" to the specific Enterprise program.



Yes. They are not paying the devs. They are paying some random dude for hacked apps.

It's unclear how some random dude gets the app in the first place. There may be a technical means to re-sign the .ipa. But in normal Enterprise distribution, there is re-signing, but it has to be done from a DEVELOPER build. Not a DISTRIBUTION build. (I think - going on a vague memory of a project I worked on a couple years ago, and I did not deal with the Enterprise distribution of the app - just did the development, some IT people at the company dealt with the distribution. They have a number of internal apps, and team that deals with the IT.)

The random dude may be getting the source code from sloppy developers. The random dude may be buying the source code from some hacker that got it from sloppy developers. The random dude might have gotten necessary certificates from an Apple developer account of a sloppy developer. Any or all of the above. Bottom line is, some random dude has STOLEN some developer's work, and is selling it outside of the app store.

The reason they have to do it outside of the App Store is because Apple won't allow a duplicate app to be sold in the App Store. If you steal the code for Angry Birds, and call it My Angry Birds. Or even Evil Bluejays - Apple is going to catch you and not allow it in the App Store.

So, now we can put two and two together and see why Apple is forcing developers to use two-factor authentication to login to the developer portal now.

Hey, AT LEAST Apple was checking for duplicate, pirated apps! Google did a HUGE purge a while back, of duplicate, pirated apps - that were being sold in the Play Store!

Smart devs protect their apps in every way possible. Including encrypting everything you can get your hands on. Think your image files are unimportant? Think again. How much did you spend creating them? Apps are easily dissected if not carefully protected. Even if they don't get your code, if they get image files and database content, for example, they might have enough to make enough of a fake app (that doesn't really work, but LOOKS like yours) to scam people out of their money.

Thank you! You'd imagine the good folks at Spotify and Rovio would be careful with their apps.

 

[I7guy]

Apple has been revoking these certificates on a continuous basis throughout these years, it wasn't until recently that they issued massive ban waves. Perhaps you should read my full comment before embarrassing yourself. And yes, I am allowed to speculate.

Sure your allowed to speculate as well as post whatever embarrassing spin you want. And in that vein I’m “allowed” to comment on your “opinions”.

 

[cmaier]

You don't need to enrol a phone; theoretically anyone can install an enterprise-signed app on any phone. I've tested this myself: I can install our in-house apps on my personal phone and nothing stops it.

So? There’s no rule against that, as long as you are an employee. In many enterprises, it’s bring-your-own-device anyway. The rule is that the enterprise developer is only supposed to provide members of the enterprise (employees, contractors, etc) with the software. The rule doesnt require that the enterprise own or control the phone.

 

[willmtaylor]

Misuse of Apple's enterprise developer program certificates continues to make news, with a new report from Reuters outlining how software pirates have been using the program to distribute hacked versions of popular apps like Minecraft, Pokemon Go, Spotify, Angry Birds, and more.

The software pirates in turn make money by charging some users annual subscription fees for "VIP" versions of their hacked apps that are "more stable than the free versions."

After being alerted by Reuters to these developer accounts being used to distribute hacked apps, Apple removed a number of them, but more have since sprung up to take their place.

Revelations regarding abuse of Apple's enterprise developer program surfaced late last month, led by word that Facebook and Google were using the program to distribute market research apps to users that were capable of tracking all of their online activity in exchange for rewards.

Apple briefly revoked enterprise certificates for both companies, which had the side effect of temporarily disabling Facebook's and Google's internal apps including custom testing versions of their own public apps as well as private internal apps for corporate use such as transportation and food.

And just yesterday, additional abuse of Apple's enterprise program came to light in the form of apps featuring adult content and gambling that can not be distributed through the traditional App Store due to Apple's rules prohibiting or limiting those types of content.

Apple today announced that as of February 27, all developer accounts will require two-factor authentication to be turned on, a move that will help secure these accounts and limit their ability to be traded or sold amongst those seeking to skirt Apple's rules.

Article Link: Apple's Enterprise Developer Program Also Being Used to Distribute Hacked Apps

C’mon MR editorial staff, you can do better than “more have since sprung up.” Let’s call the dev/app approval system/walled garden what is really is: BROKEN.

 

[Scottsoapbox]

So basically the walled garden has a huge gate labeled enterprise certificate.

The problem for Apple is that both education and (legit) enterprise both want additional control and app side loading. So how do you stop abuse without making it to much of a hassle or expense for legit users (that they would switch platforms)?

 

[sdugoten]

Then leave the Apple ecosystem. Nobody is going to listen to what one insignificant person has to say about this.

insignificant ? I think the number of people using sideloading their app like Kodi / torrent app are in hundred thousands...

You should check out some of those most famous paid sideloading service on the internet and check how many active users they have. I am not even counting those free sideloading service out there.

 

[nt5672]

Just like the war on drugs that never worked, Apple should just embrace the fact the it will have to allow Apps that do not meet its political correctness standards. People would not go to these extreme measures if they could load the software they want on their phone.

 

[agffth]

Bingo. The only one who gets it. You've paid for the device but Apple take away your freedom to do whatever you wish with it. Imagine buying a Mac but Apple doesn't allow you to run emulators, Kodi, torrent clients, etc. Perhaps that's why they want to replace Macs with iPads to limit what you can do without going through their app store and services. Piracy is just a guise to take away your freedom and force upon a fascist authoritarian rule ecosystem.

Uninstall iOS and install a different OS, problem solved.

 

[willmtaylor]

Just like the war on drugs that never worked, Apple should just embrace the fact the it will have to allow Apps that do not meet its political correctness standards. People would not go to these extreme measures if they could load the software they want on their phone.

Sounds like you’re largely missing the point if you think this is a PC issue.

 

[az431]

What year is this, 2010??

You may want to open the App Store app and check before making nonsense comments.
[doublepost=1550152490][/doublepost]

Bingo. The only one who gets it. You've paid for the device but Apple take away your freedom to do whatever you wish with it. Imagine buying a Mac but Apple doesn't allow you to run emulators, Kodi, torrent clients, etc. Perhaps that's why they want to replace Macs with iPads to limit what you can do without going through their app store and services. Piracy is just a guise to take away your freedom and force upon a fascist authoritarian rule ecosystem.

You're free to buy any device you want. Buying it, agreeing to the terms of use, and then complaining about it is disingenuous. Kind of like moving to Iran and complaining about the "fascist authoritarian rule."
[doublepost=1550152689][/doublepost]

Perhaps Tim can quit exerting so much control over what I want on my phone. Why can't I have torrent clients? Why can't I set custom DNS?

If you want that level of control get a phone from a company that doesn't care about security and privacy: Google, Samsung, Huawei.

I didn't read the linked article, but how are developer certificates used to share applications with general users who aren't in the developer program?

And does the article really imply that people are not paying the devs via the app store, but paying some random dude for apps? And angry birds and spotify? Do these "pirated" apps bypass IAPs and subscription charges somehow?

Read the article

 

[pastimage]

Piracy exists on every platform. It will never stop.

Im in. Lets go. where do I sign up? You see piracy is what was started by the CROWN! This started many years ago and will never end. Why should it? they can steal from you and me but if it is done in reverse and without a government stamp it is a bad thing. Whatver.

(not direceting this post at gplusplus or anyone else)

 

[I7guy]

...Perhaps Tim can quit exerting so much control over what I want on my phone. Why can't I have torrent clients? Why can't I set custom DNS?

What about Steve? Or was iOS an open platform until Tim took control of Apple. Very disingenuous statement.

 

[Carlanga]

This has been used for yearsssss

 

[MacBH928]

I have seen Operating Systems without regulations. I like to use Apple because they have a walled garden...
In all honesty, if you want to do whatever you want with your phone go ahead and buy an Android device...

The only real advantage for the iPhone its the solid, safe, and stable software experience...

 

[willmtaylor]

I have seen Operating Systems without regulations. I like to use Apple because they have a walled garden...
In all honesty, if you want to do whatever you want with your phone go ahead and buy an Android device...

The only real advantage for the iPhone its the solid, safe, and stable software experience...

And virtually seamlessly across multiple (types of) devices.

 

[lunarworks]

Just like the war on drugs that never worked, Apple should just embrace the fact the it will have to allow Apps that do not meet its political correctness standards. People would not go to these extreme measures if they could load the software they want on their phone.

What does pirate Spotify have to do with political correctness? This "PC" persecution complex is so tiresome.

Apple has been revoking these certificates on a continuous basis throughout these years, it wasn't until recently that they issued massive ban waves. Perhaps you should read my full comment before embarrassing yourself. And yes, I am allowed to speculate.

It's the shark attack principle. If the media reports on one shark attack, you'll hear reports about other shark encounters every week for the rest of the summer.

 

[sdugoten]

Uninstall iOS and install a different OS, problem solved.

In 2010 and 2012, the U.S. Copyright Office approved exemptions that allowed smartphone users to jailbreak their devices legally,[79] and in 2015 the Copyright Office approved an expanded exemption that also covers other all-purpose mobile computing devices, such as tablets.

that means, user is entitle to do whatever he feel like on their own phone LEGALLY , including but not limited to jailbreak, sideloading or install whatever app without asking Apple what they think its politically correct.

 

[now i see it]

Just goes to show what happens when you step outside the walled garden fortress.