Apple Turns on HTTPS for App Store, Prevents Password and App Stealing [Video]

Posted March 9, 2013 at 6:18pm by iClarified | Please help us and submit a translation by clicking here | 10560 views

Apple recently turned on HTTPS for the App Store preventing a slew of possible attacks including password stealing, app swapping, fake app upgrades, app installation prevention, and privacy leaks.

Elie Bursztein of Google is credited with reporting the vulnerabilities to Apple, according to an Apple Web Server Notifications document posted two weeks ago.

2013-01-23 itunes.apple.com
Active content is now served over HTTPS by default. We would like to acknowledge Bernhard 'Bruhns' Brehm of Recurity Labs, Elie Bursztein of Google, and Rahul Iyer of Bejoi LLC for reporting this issue.


In a blog post yesterday Bursztein outlines and even demos the attacks that used to be possible.

Password stealing: Trick the user into disclosing his or her password by using the application update notification mechanism to insert a fake prompt when the App Store is launched.

App swapping: Force the user to install/buy the attacker’s app of choice instead of the one the user intended to install/buy. It is possible to swap a free app with a paid app.

App fake upgrade: Trick the user into installing/buying the attacker’s app of choice by inserting fake app upgrades, or manipulating existing app upgrades.

Preventing application installation: Prevent the user from installing/upgrading applications either by stripping the app out of the market or tricking the app into believing it is already installed.

Privacy leak: The App Store application update mechanism discloses in the clear the list of the applications installed on the device.

Check out the video demos below or hit the link for details on each attack scenario, sample code, and more.

Read More [via Marcus]






Share
Add Comment
Suhailyosuf - March 10, 2013 at 6:00pm
Good. suhailyosuf@gmail.com
Brawlbro1 - March 9, 2013 at 8:20pm
Wow. Holy fuck. The app stealing password happened to my device so many times. I didn't type in my password when that it pr
Brawlbro1 - March 9, 2013 at 8:24pm
*promt me to do. I ignored it. Lucky me I guess.
Dyllon - March 9, 2013 at 6:53pm
Wow this could've been a really big thing. It's funny some guy from google had to save Apple they seems to be missing things left to right these days Password lock hacks all sorts of vulnerabilities Tim Cook really needs to get on some shit pay attention Because whoever he has on security isn't doing the greatest job
Follow iClarified
Disney Movies Anywhere App Now Lets You Pause and Resume Downloads
The Disney Movies Anywhere app has been updat...
Apple Airs New 'Powerful' iPhone 5s Ad [Video]
Apple has aired a new 'Powerful' ad for the i...
Amazon Updates Kindle App for iOS With Table of Contents, X-Ray Smart Look-Up Improvements
Apple Updates AirPort Extreme and Time Capsule With Heartbleed Fix
Apple has released a firmware update for the ...
Apple Announces Updates to App Ratings, New Games Rating System for Brazil