Apple Bans iPhone App That Warned If You Had Been Secretly Hacked
Posted on
by
Graham Cluley
Apple has banned a top-selling iOS app that raised the alarm if it determined your iPhone or iPad had been jailbroken without your knowledge.
The app, “System and Security Info,” was only released a week ago and made its way rapidly to the top of the paid-for app charts, outselling the likes of Minecraft and Grand Theft Auto.
I don’t think anyone really expected System and Security Info to maintain a lead over such popular, heavyweight video games for long, but I certainly didn’t anticipate Apple throwing it out of the iTunes Store quite so quickly either.
System and Security Info is developed by noted security researcher Stefan Esser who has made a name for himself by uncovering zero-day vulnerabilities in Apple’s code, and for his low opinion of the quality of Apple security.
Over the weekend, Esser posted on Twitter that his app had been banned, because (in Apple’s words):
“[T]here is no publicly available infrastructure to support iOS diagnostic analysis. Therefore your app may report inaccurate information which could mislead or confuse your users.”
Esser, of course, is unimpressed with that ruling:
“It basically says: we do not want our users to have the impression iOS could have security holes. go away.”
You can certainly understand the viewpoint of Esser and those iOS users who bought his app (declaration: I’m one of them). Apple’s position seems to be that, because it hasn’t provided any accurate official way for users to check if their devices are secure, they are not going to allow any apps to suggest that devices might not be secure.
And seeing as Esser has found countless Apple-related vulnerabilities over the years (some of which, he contends) the company still hasn’t fixed properly, I feel inclined to trust him that he knows what he’s talking about (even if I don’t always agree with how he goes about saying it).
After all, if there was even a 1% chance that my iPhone might be jailbroken I would prefer to know about it rather than left in the dark, oblivious to the possible threat.
In a later tweet, the clearly-riled Esser makes clear that he believes he is being singled out by Apple, pointing out that others (such as security firm G DATA) still have apps available for download from the iOS App Store that offer jailbreak detection.
Another iOS jailbreak detector that is not killed because it is not … G DATA Internet Security by G DATAhttps://t.co/Ui3CpKC7uE
— Stefan Esser (@i0n1c) May 16, 2016
The ideal solution, of course, would be if iOS itself shipped with code that warned users if their devices had been jailbroken, and might have fallen victim to a hacker, jealous partner or stalker who wants to track an individual’s online activities and location.
If Apple were to provide such a utility, and coded it effectively, then there would hopefully be no need for a tool from a third-party like Esser.
And there’s another takeaway from this spat between Apple and this security researcher. On three occasions (due to bug fixes, and so forth) the System and Security Info app went through Apple’s review process without any concerns being raised about its ability to detect jailbreaking.
It was only on the fourth occasion, and after the app raced to the top of the charts, that it was summarily booted out on the pretext of its core functionality.
In Esser’s eyes, it’s clear that Apple’s review process is falling short:
“I hope media takes away the important fact: there is no chance at all the AppStore review process will stop anyone from smuggling stuff in.”
Do you think Apple is right or wrong to ban the System and Security Info app? Leave a comment below with your point of view.
