Apple Turns on HTTPS for App Store, Prevents Password and App Stealing [Video]

Posted March 9, 2013 at 6:18pm by iClarified | Please help us and submit a translation by clicking here | 10978 views

Apple recently turned on HTTPS for the App Store preventing a slew of possible attacks including password stealing, app swapping, fake app upgrades, app installation prevention, and privacy leaks.

Elie Bursztein of Google is credited with reporting the vulnerabilities to Apple, according to an Apple Web Server Notifications document posted two weeks ago.

Active content is now served over HTTPS by default. We would like to acknowledge Bernhard 'Bruhns' Brehm of Recurity Labs, Elie Bursztein of Google, and Rahul Iyer of Bejoi LLC for reporting this issue.

In a blog post yesterday Bursztein outlines and even demos the attacks that used to be possible.

Password stealing: Trick the user into disclosing his or her password by using the application update notification mechanism to insert a fake prompt when the App Store is launched.

App swapping: Force the user to install/buy the attacker’s app of choice instead of the one the user intended to install/buy. It is possible to swap a free app with a paid app.

App fake upgrade: Trick the user into installing/buying the attacker’s app of choice by inserting fake app upgrades, or manipulating existing app upgrades.

Preventing application installation: Prevent the user from installing/upgrading applications either by stripping the app out of the market or tricking the app into believing it is already installed.

Privacy leak: The App Store application update mechanism discloses in the clear the list of the applications installed on the device.

Check out the video demos below or hit the link for details on each attack scenario, sample code, and more.

Read More [via Marcus]

Add Comment
Suhailyosuf - March 10, 2013 at 6:00pm
Brawlbro1 - March 9, 2013 at 8:20pm
Wow. Holy fuck. The app stealing password happened to my device so many times. I didn't type in my password when that it pr
Brawlbro1 - March 9, 2013 at 8:24pm
*promt me to do. I ignored it. Lucky me I guess.
Dyllon - March 9, 2013 at 6:53pm
Wow this could've been a really big thing. It's funny some guy from google had to save Apple they seems to be missing things left to right these days Password lock hacks all sorts of vulnerabilities Tim Cook really needs to get on some shit pay attention Because whoever he has on security isn't doing the greatest job
Follow iClarified
Apple Announces That iOS 8 Adoption Has Reached 60% [Chart]
Apple has announced that iOS 8 adoption has r...
uBar is a Replacement for the Mac OS X Dock
uBar from Brawer Software is a Dock replaceme...
Skype 7.2 Released for Mac OS X
Microsoft has announced the release of Skype ...
Twitter to Start Collecting Your 'App Graph'
Starting today, Twitter users on iOS and Andr...
Natalie Portman in Talks to Join Cast of Steve Jobs Movie
Natalie Portman is reportedly in talks to joi...