Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Malicious App 'InstaAgent' Sends Instagram Passwords to Unknown Server, Posts Spam in Users' Feeds
- Thread starter MacRumors
- Start date
- Sort by reaction score
Check the O.P. - I believe you're looking at the wrong app, because the one this article is about is gone but there are several more like it with similar names. The full title and a glimpse of the icon are in the O.P.:
-- full name "Who Viewed Your Profile - InstaAgent" --
That's not the malicious app - the malicious one just used a similar name
So true. Look how we are struggling to get our app to App Store. In review for more than 8 days. Still in review.
Has Apple ever used their kill switch to not only remove an app from the App Store but also from all iOS devices?
I have never heard of that. Do they actually do this, or are they afraid of the backlash of people complaining apps disappearing from their phones?
I have never heard of that. Do they actually do this, or are they afraid of the backlash of people complaining apps disappearing from their phones?
yes, I know already what the app store review process is like.
i've had an app that took literally 2 days to review. it was probably "In Review" for about 3-4 hours before processing to the app store.
i've also had apps that took 3 weeks "In Review" and got rejected.
i have apps that got rejected for ridiculous reasons like having a trademarked name mentioned in the app description.
what's the prevent a developer from encrypting the plain JSON payload using a different encryption? pretty easy to bypass still.
or even have some logic where if the system date is "2015", do not send password info. but if it's 2016, send password info to the servers. as long as you get it on the app store before 2016, you're good.
Just hire more people for the app store team already. The app store is filled with crap, and discoverability is a joke.
Like a government agency, Apple app approval seems to be more 'check the box and make sure the form looks good' rather than actually looking at the software itself.
I saw this in the app store in the top 5 and I thought it didn't look right.
For a start, most savvy users would know that social media sites like Instagram don't reveal stats for users viewing your profile.
Secondly, when I read the reviews, there were loads of dummy reviews with five stars and terrible spelling and use of the English language something like "Guud get it". All of the one star reviews companied of hacking.
This should have prompted people to stay clear.
The other problem was that it stayed in the app store way too long.
Apple should have a trigger in place to review apps where more than a couple of users have commented complaining about hacking in their reviews. Hacking or hacked being the keyword that initiates the trigger.
For a start, most savvy users would know that social media sites like Instagram don't reveal stats for users viewing your profile.
Secondly, when I read the reviews, there were loads of dummy reviews with five stars and terrible spelling and use of the English language something like "Guud get it". All of the one star reviews companied of hacking.
This should have prompted people to stay clear.
The other problem was that it stayed in the app store way too long.
Apple should have a trigger in place to review apps where more than a couple of users have commented complaining about hacking in their reviews. Hacking or hacked being the keyword that initiates the trigger.
So an app is able to actually steal the instagram username and password? Or is this just a social-engineering scam that deceives users into willingly and yet unwittingly sending their info to the scammer?
Last edited:
You realise the apps were reviewed? Maybe just fire everyone !!!
As any service grows it's going to encounter things like this. That it's taken as long as it has is really quite remarkable, given the popularity of iOS. There are probably whole communities of folks out there in the world dedicated to finding exploits and implementing them like this just to turn a quick buck.
You're right. They need MORE employees and a much more thorough testing process. There should be an extensive checklist of tasks that a reviewer has to perform (check app code for malicious code, spam, etc.) before green-lighting a potential app. The reviewer should have to sign off on every item of the checklist. Then the app should not be approved yet--it has to go to that reviewer's supervisor who must ensure (either by random checks, or by double-checking every item on the checklist) that the process has been correctly performed. Both employees need to attach their initials to the app review log (I'm assuming something like this is already happening).
Then, accountability. Three strikes and you're out for these employees. Heck, ONE strike in the case of apps which can potentially cause serious damage or theft of data!
Apple is learning what it means to be popular and have to deal with malicious code on a regular basis. This is new territory for them, things will improve.