Developer Demonstrates Serious Security Breach in iOS, Apple Bans His Account
November 8, 2011 9:06 AM
comment(s) - last by
Ban first, ask questions later
Many companies like Google Inc. (
), Microsoft Corp. (
), and the Mozilla Foundation reward developers with
bounties of thousands of dollars
for finding and exposing security flaws in their products. Apple, Inc. (
) rewards developers by kicking them out of the company's development program.
I. Tell Apple Its Security Problems, Get Kicked Out
Long-time Mac and iDevice hacker Charlie Miller [
] found this out the hard way this week when Apple unceremoniously revoked his developer privileges.
The incident occurred after Mr. Miller created an app called Instastock, which carried out a proof-of-concept attack using a bug he found in the iPhone's built-in Safari browser. Safari, from iOS 4.3 onward, apparently was allowing unsigned code to be placed in memory and run.
Code signing is the biggest line of defense for iPhone owners. Any app installed on the iPhone must first receive a special authorization (signature) from Apple via the App Store submission process. While it is quite popular to turn off Apple's code signing protections in order to "jailbreak" iPhones -- allowing banned apps and forbidden customizations -- the exploits that allow this to be done also potentially allow malicious code to be executed.
For that reason, rather than gifting his discovery on the jailbreaking community, Mr. Miller instead opted to carefully test his discovery and then approach Apple about it.
Apple has banned Charlie Miller for exposing its flaws. [Source: YouTube]
Testing began with his Instastock app, which using the exploit performed innocous proof-of-concept mischief that would typically be forbidden, such as making the phone vibrate, downloading the contacts list to an attached computer, or launching an external YouTube video.
Instastock, Mr. Miller's app, masqerades as an innocous stock tracking app [Source: YouTube]
Mr. Miller then approached Apple, giving the company fair warning and a chance to fix the bug before he published his findings at the
in Taipei (Nov. 17-18). Rather than politely compensate Mr. Miller for finding their mistake and warning them before a malicious party found it and attacked users, Apple instead reacted quite negatively to these developments.
Apple pulled Mr. Miller's app from the App Store -- which was pretty understandable given that while it wasn't doing anything outright malicious, it was using unauthorized functionality. But what it did next was far more troublesome -- it kicked Mr. Miller out of its developer program, citing violations in the developer terms of service.
II. The Boot
Apple wrote Mr. Miller (
Subject: Notice of Termination
Date: November 7, 2011 4:49:34 PM CST
Dear Charles Miller:
This letter serves as notice of termination of the iOS Developer Program License Agreement (the "iDP Agreement") and the Registered Apple Developer Agreement (the "Registered Developer Agreement") between you and Apple, effective immediately.
Pursuant to Section 3.2(f) of the iDP Agreement, you agreed that you would not "commit any act intended to interfere with the Apple Software or related services, the intent of this Agreement, or Apple's business practices including, but not limited to, taking actions that may hinder the performance or intended use of the App Store or the Program". Further, pursuant to Section 6.1 of the iDP Agreement, you further agree that "you will not attempt to hide, misrepresent or obscure any features, content, services or functionality in Your submitted Applications from Apple's review or otherwise hinder Apple from being able to fully review such Applications." Apple has good reason to believe that you violated this Section by intentionally submitting an App that behaves in a manner different from its intended use.
Apple may terminate your status as a Registered Apple Developer at any time in its sole discretion and may terminate you upon notice under the iDP Agreement for dishonest and misleading acts relating to that agreement. We would like to remind you of your obligations with regard to all software and other confidential information that you obtained from Apple as a Registered Apple Developer and under the iDP Agreement. You must promptly cease all use of and destroy such materials and comply with all the other termination obligations set forth in Section 12.3 of the iDP Agreement and Section 8 of the Registered Developer Agreement.
This letter is not intended to be a complete statement of the facts regarding this matter, and nothing in this letter should be construed as a waiver of any rights or remedies Apple may have, all of which are hereby reserved. Finally, please note that we will deny your reapplication to the iOS Developer Program for at least a year considering the nature of your acts.
Sincerely, Apple Inc.
Mr. Miller quickly fired off a post to Twitter, commenting:
OMG, Apple just kicked me out of the iOS Developer program. That's so rude!
The post drew the sympathy of Microsoft developer relations officer Brandon Watson who offered Mr. Miller a free developer subscription on Microsoft's Windows Phone platform, writing:
, sorry iOS credentials went missing. Want a free Windows Phone dev account?
folks love the platform.
Of course Mr. Miller is likely going to keep on hacking Apple devices, but the Microsoft post is a clever bit of PR in that it helps illustrate the major difference in approach between Apple and Microsoft -- or Apple and most software firms, for that matter.
This incident isn't terribly surprising for a company that reportedly ordered its employees to lie to customers about malware and who steadfastly insists that its devices are
too "magical" to be vulnerable
to traditional attacks.
Brandon Watson (Microsoft)
This article is over a month old, voting and posting comments is disabled
RE: Interesting turn of events
11/8/2011 1:26:17 PM
Bite the Apple and refuse to swallow it... and you'll soon find that you've been spit out.
RE: Interesting turn of events
11/8/2011 1:35:18 PM
Sign a contract that spells out what is allowed and then violate the contract & publicly announce the violation in a manner that is embarrassing to the other party. Errors in judgment tend to bite you in the ass. When embarrassing a multi-billion dollar company this badly, expect them to use a Mamba to do the biting. Apple's response could be considered rather restrained :P
Microsoft might have been more subtle, but you can be sure a similar embarrassment to MS would have gotten a response that the person embarrassing MS would find ... uhm ... "less than desirable".
RE: Interesting turn of events
11/8/2011 2:31:38 PM
Microsoft would actually have started work on a solution to the security hole and sent the person or security company who found the flaw confirmation that they were doing so.
MS probably also would have asked the developer for a bit of time before showing how the flaw worked until after a fix was worked out.
Only Apple can get away with trying to ignore the problem then kicking a developer who won't let them ignore the problem that he called to their attention for 6 months or so.
"The whole principle [of censorship] is wrong. It's like demanding that grown men live on skim milk because the baby can't have steak." -- Robert Heinlein
Google, Mozilla Bump Top Award for Critical Bugs to $3,000
July 21, 2010, 9:39 AM
Charlie Miller to Unveil 20 Zero-day OS X Exploits at CanSecWest
March 19, 2010, 9:55 AM
Apple's iPhone Executes SMS Binary Code as Root, Fix Won't Come Until End of Month
July 2, 2009, 3:38 PM
Mac Gets The Girl In New Anti-Microsoft Ad
May 13, 2009, 9:33 AM
Apple's Safari Security Woes
March 31, 2008, 12:22 PM
UK Drivers Must Now Give Their Cell Phones to Police After a Crash
July 29, 2014, 4:37 PM
Ford to Switch 3,300 Employees from BlackBerries to Apple iPhones by Year's End
July 29, 2014, 2:08 PM
Quick Note: Hilton Hotels to Use Smartphones as Room Keys, for Check-In/Check-Out
July 29, 2014, 12:53 PM
Verizon Wireless to Receive Exclusive "HTC One (M8) for Windows" Smartphone
July 29, 2014, 9:13 AM
Report: Microsoft's Chinese Offices Raided
July 28, 2014, 9:16 PM
Cell Phone Unlocking Bill Heads to President Obama's Desk
July 28, 2014, 11:58 AM
Most Popular Articles
Facebook Will Force Android, iOS Users to Use Messenger App This Week
July 29, 2014, 11:26 AM
Sony's Xperia Z3 Gets Detailed in Leaked Photos
July 25, 2014, 2:30 PM
Ford's Extensive Use of Aluminum in '15 F-150 Results in $395 Increase for Base Models
July 28, 2014, 3:02 PM
Report: Apple to Launch 12" Retina MacBook Air, 4K Desktop Product Later this Year
July 24, 2014, 4:33 AM
Pentagon's Priciest Project, F-35, Misses International Debut
July 25, 2014, 10:18 AM
Latest Blog Posts
Space Terrorism is a Looming Threat For the United States
Apr 23, 2014, 7:47 PM
Facebook Aims to Provide Internet to "Every Person in the World" with Drones, Satellites
Apr 1, 2014, 10:20 AM
Retail Mobile Sites Experience Outages in Light of Simplexity's Bankruptcy
Mar 14, 2014, 8:48 AM
Tesla vs. BMW: Who Has the Safer EV?
Feb 1, 2014, 2:56 PM
Justice Leaks Details of Next HTC One Two Flagship Phone
Dec 5, 2013, 4:04 PM
More Blog Posts
Copyright 2014 DailyTech LLC. -
Terms, Conditions & Privacy Information