Apple’s pretty proud of its App Store approval system. Too bad security hacker Andy Miller found a code-signing flaw that allows good apps to go bad. Here’s how an app downloaded from the App Store could become a malware threat.
What Miller has discovered is that hackers can create an app that passes Apple’s strict app vetting process and once that app is in the App Store can exploit a flaw in the code signing of Apple’s devices. The flaw is found in iOS 4.3 and later. At issue is that javascript is now allowed to run at a much deeper level than before to speed up mobile Safari. Apple actually created an exception for the browser to run unapproved code in an iOS devices memory.
Because of this, an Apple-approved app can phone home once launched and download malicious code that can run amok on the iOS device. A hacker could see a user’s contacts and photos, play sounds on the phone and activate vibrate mode. While remotely making an iPhone vibrate sounds innocuous, control of these aspects of an iOS device could potentially lead to control of other features. Check out the video above of the flaw in action.
Apple has already pulled Miller’s proof-of-concept InstaStock app from the App Store. Miller plans to demonstrate the flaw next week at the SysCan conference in Taiwan. [Forbes via Cult of Mac]