Computer scientists say they found a way to sneak malicious programs into Apple’s exclusive app store without being detected by the mandatory review process that’s supposed to automatically flag such apps.
The researchers from the Georgia Institute of Technology used the technique to create what appeared to be a harmless app that Apple reviewers accepted into the iOS app store. They were later able to update the app to carry out a variety of malicious actions without triggering any security alarms. The app, which the researchers titled “Jekyll,” worked by taking the binary code that had already been digitally signed by Apple and rearranging it in a way that gave it new and malicious behaviors.
My two cents: As a developer, I am not alarmed by this, as much as surprised no one figured out a way to do this earlier. This is why Apple’s App Store model works. There’s a choke-point for this type of mechanism. It’ll be interesting to see Apple’s response.
