Pirated Movie App Disguised as Vision Test Snuck Onto App Store

[CheesePuff]

So what’s the point of app review in the first place?

Well IMO they shouldn't let web wrappers in.. it appears that is what this app is, simply embedding an external site so they changed content once it was approved. I could have swore there was an App Store policy that prohibited submitting an app that was just a website wrap

 

[dk001]

There needs to be accountability. They know who clicked "Approve". That person needs to be brought in for their own review and enhanced training.

Apple should publish this type of info — "Johnny B. approved this app on March 7, 2023". Put the name out there for the public to see.

Unless it is automated.

 

[dk001]

I guess the gardeners have called it quits.

Too much fertilizer.

 

[satchmo]

People blaming Apple here likely have no idea how apps can function. It’s entirely possible this is either a web app that changed the functionality once it was approved, or if it is a native app, they probably had a remote feature flag that they changed after the app was approved. Both are incredibly simple to implement.

I’m not saying I guarantee Apple is not at fault, but there are VERY simple ways to get past app review and then completely change up the app functionality.

Help me understand. If this is the case, what does that say about security of the App Store?

And are there a flood of apps that are currently in the store that are flying under the radar?

 

[I7guy]

Help me understand. If this is the case, what does that say about security of the App Store?

And are there a flood of apps that are currently in the store that are flying under the radar?

It doesn’t bode well for alternative app stores.

 

[G5isAlive]

There needs to be accountability. They know who clicked "Approve". That person needs to be brought in for their own review and enhanced training.

Apple should publish this type of info — "Johnny B. approved this app on March 7, 2023". Put the name out there for the public to see.

um no. just plain no. Perhaps I missed the /s on your comment. This is and should remain an internal Apple matter. Sorry if I missed the joke.

 

[klasma]

I wonder what/who is to blame here. Does Apple place an unrealistic goal of apps per day on their testers or did one of these folks wake up one day feeling a little lazy?

This is unlikely to be a very well-payed job, and is prone to become all a blur after the first couple hundred of app submission reviews. It's a rather thankless task, and Apple probably allows for too little time per review. Anyone really qualified will likely be looking for a more interesting job elsewhere. One thing they could do is to have each submission be reviewed by three or five people independently, and have a majority vote taken.

Edit: Something like #36 is probably correct.

 

[Jim Lahey]

I kind of always imagined that Apple had the ability/policy to decompile the source code of all submitted apps and have it automatically checked for signs of nefarious intent, but I guess either they don’t or it’s very difficult to detect.

 

[JosephAW]

Downloaded the wrong app, Got Temu instead.

 

[matrix07]

This is a great idea. I hope tushy.com do the same 😅

 

[ethanwa79]

Here's how it got approved:

1. When the App Review team opened it, the app was a vision test. It sent up a request to a URL that has a yes/no flag to turn on the free movies, and the server returned "no".

2. Apple approved the app as a vision test.

3. The developer then switched the flag on the server to a "yes". When the app detected a yes from users who download the app and opened it, it then just shows all the views needed to display the movie stuff.

It's super simple to trick Apple's App Store QA process. It's honestly a false sense of security, like a gated-community. They are still easy to rob, they just put up enough barriers to make it so that you need to know what you're doing.

It's like security by obfuscation. It's not really that secure.

 

[truthsteve]

They’d probably do a better job than Apple is doing currently.

this makes no sense

 

[McG2k1]

I feel like there’s some missed headline opportunities here. Report: Entire App Review Team Fails Eye Test.

 

[McG2k1]

Here's how it got approved:

1. When the App Review team opened it, the app was a vision test. It sent up a request to a URL that has a yes/no flag to turn on the free movies, and the server returned "no".

2. Apple approved the app as a vision test.

3. The developer then switched the flag on the server to a "yes". When the app detected a yes from users who download the app and opened it, it then just shows all the views needed to display the movie stuff.

It's super simple to trick Apple's App Store QA process. It's honestly a false sense of security, like a gated-community. They are still easy to rob, they just put up enough barriers to make it so that you need to know what you're doing.

It's like security by obfuscation. It's not really that secure.

If it’s this easy then there are thousand and thousands of corrupt apps on the store.

 

[needsomecoffee]

It would be much more secure to install an app from a recognized Trademark owner's website... Microsoft.com let's say (has worked for decades for MacOS). The App Store has so many scam apps leveraging Trademark searches. No way Apple can screen the apps, and I do not believe Apple has any real desire to limit ad dollars for searches on TM names. Yet Apple falsely claims they curate everything creating a very damaging FALSE sense of security for the average user. Of course locking everything into a store controlled by Apple and skimming 30% is a strong incentive to keep the ball rolling. Hard to believe with just about 1K Vision Pro apps that reviewers missed this. Well maybe not given the level of scam apps in the iPhone store.

 

[TurboDrooler]

BWOAH

 

[hagar]

There needs to be accountability. They know who clicked "Approve". That person needs to be brought in for their own review and enhanced training.

Apple should publish this type of info — "Johnny B. approved this app on March 7, 2023". Put the name out there for the public to see.

That’s just insane. Apple wouldn’t find anybody anymore who wants to click the Approve button.

 

[vipergts2207]

Arguments for Apple’s superior app review process in absolute shambles.

 

[davepete]

As somebody who has submitted >1000 app versions to the App Store, I am occasionally astonished when an app gets approved within 10 minutes of submission. I assume some of the testers are not diligent. Whoever approved this piracy app -- somebody should verify all the other apps they've been approving.

 

[falkon-engine]

Maybe they’re testing the vision of what an app can be in an EU App Store outside the control of Apple.

 

[fathobbit]

There needs to be accountability. They know who clicked "Approve". That person needs to be brought in for their own review and enhanced training.

Apple should publish this type of info — "Johnny B. approved this app on March 7, 2023". Put the name out there for the public to see.

You’re delusional. The one that is accountable is Apple.

 

[PhoenixAnhart]

If something as evident as this made its way to the App Store, who knows what else could be hidden on other apps…

Your takeaway instead should be that Apple's "our walled garden is infinitely safe" is marketing and purely profit seeking bs that an entire community of people have swallowed.

 

[redheeler]

If EU had their way, pirated apps for all.

You do realize all of this content is accessible via the web browser, and has been for years, right?

 

[redheeler]

Here's how it got approved:

1. When the App Review team opened it, the app was a vision test. It sent up a request to a URL that has a yes/no flag to turn on the free movies, and the server returned "no".

2. Apple approved the app as a vision test.

3. The developer then switched the flag on the server to a "yes". When the app detected a yes from users who download the app and opened it, it then just shows all the views needed to display the movie stuff.

It's super simple to trick Apple's App Store QA process. It's honestly a false sense of security, like a gated-community. They are still easy to rob, they just put up enough barriers to make it so that you need to know what you're doing.

It's like security by obfuscation. It's not really that secure.

Apple has built a closed-source ecosystem. It comes with the territory.

People might wonder why open-source is important. Well this is a good example of why.

 

[firewood]

Arguments for Apple’s superior app review process in absolute shambles.

Apple's review process is still clearly superior if all the alternative app stores are in worst shambles (e.g. if they contain a significantly higher percentage of bogus, spam, or malware apps than Apple's stores).