Malicious app penetrates iTunes store to test security

Close-up of iPhone apps Apple has been keen to keep a close control over its apps

Related Stories

A malicious piece of software designed for iPhones and iPads has been created to show that Apple's app store is not immune to malware.

The code was designed to look like a stock price tracker, but was also able to steal data.

Experts said that the proof-of-concept program was a "significant threat" to the app store.

Apple declined to comment. It also removed the app and barred the developer from its store.

The software was created by security expert and hacker Charlie Miller to demonstrate Apple's vulnerabilities.

The firm accepted the program to its iTunes app store in September. Two months later Mr Miller revealed that it contained malware that could remotely download pictures and contacts.

"Until now you could just download everything from the app store and not worry about it being malicious. Now you have no idea what an app might do," he said.

The InstaStock app took advantage of a recent update to Apple's mobile operating system which allowed non-approved code to be added to installed apps for the first time.

A few hours after Mr Miller disclosed the flaw, he received an email from Apple which said he was barred from the iOS developer program for violating its terms and conditions.

He wrote on Twitter: "First they give researchers access to developer programs, (although I paid for mine) then they kick them out.. for doing research. Me angry."

Mr Miller has made something of a habit of exposing Apple's security flaws.

In 2009 he identified a bug in the iPhone's text-messaging system that allowed attackers to gain remote control over the devices.

He has since exposed other vulnerabilities in Apple's Mac and mobile platforms.

Mr Miller plans to present his research at a security conference in Taiwan on 17 November.


The app he created was described as "the most significant threat yet to Apple's app store economy", by independent mobile analyst Ian Fogg.

"Apple has been widely criticised for the way in which it limits what code developers can use but this suggests that it was probably right to do that," he added.

To date Apple's biggest security threat has been to the minority of its devices that have been modified.

So-called jail-broken handsets appeal to more tech-savvy users who want to introduce non-Apple approved software to their handsets.

However, many experts believe Apple's app store is still more secure than many of its rivals'.

"The Android marketplace has a supply chain that is rather less controlled and therefore offers more potential to malware writers," said Graham Titterington, an analyst with research firm Ovum.

But he added that this malicious iPhone app could be "the first of many".

More on This Story

Related Stories

The BBC is not responsible for the content of external Internet sites

More Technology stories



  • PlanesTest of nerve

    WW1 fighter pilots who navigated using a school atlas

  • Pauline Borghese What the butler saw

    Scandalous tales from the British embassy in Paris

  • A baby holds an adult's fingerSmall Data

    The time when the average age of death was zero

  • League of LegendsBattle for glory

    On the ground at League of Legends World Championship's final

  • Vinyl record pressing in AustraliaVinyl vibe

    Getting into the groove with Australia's last record maker

BBC © 2014 The BBC is not responsible for the content of external sites. Read more.

This page is best viewed in an up-to-date web browser with style sheets (CSS) enabled. While you will be able to view the content of this page in your current browser, you will not be able to get the full visual experience. Please consider upgrading your browser software or enabling style sheets (CSS) if you are able to do so.