Skip to content

iOS still vulnerable to zero days; Apple apologises for delay

  • by
  • 3 min read

Since Denis Tokarev publicly revealed four zero-day vulnerabilities in iOS last Friday, Apple has reached out to the developer apologising for the delay in responding and said they’re still investigating these issues.

Tokarev had reported all bugs to Apple between March 10 and May 4. One of those bugs got quietly patched in iOS 14.7 without crediting the researcher. After repeated attempts to contact Apple and inquire what was going on, Tokarev published the PoC source code on Github, which makes it extremely easy for anyone to exploit these vulnerabilities.

In his follow-up post published on Monday, Tokarev explains how the Apple App Store checks apps for security flaws and essentially disputes Apple’s claim that their App Store is safe. 

In the News: iPhone apps track you, whether you want them to or not


How do malicious apps get on the App store?

In his follow-up post published on Monday, Tokarev explains how the Apple App Store checks apps for security flaws and essentially disputes Apple’s claim that their App Store is safe. 

When a binary file for an app is uploaded to the App Store, it checks a list of strings inside the binary file against a predefined set of private API that only Apple’s apps are allowed to use. If a private API is found, the app will not make it to the play store, and Apple will send you an email with what they found. 

This is called static analysis. However, apps can get around this by either splitting your API into a few parts to conceal it or using the Caeser Cipher to get around these restrictions.

Next up is the review process where a reviewer downloads the app to their iPad, go through its various screens and then approve or reject the app based on “their understanding of the App Store Review Guidelines biased by their own subjective opinions and attitudes.”

An app can get around this by connecting to a remote server which in turn will detect whether or not a review or general user is using the app. This means that a reviewer will see a totally different app as compared to a general user. 

Tokarev has also pointed out Apple’s anticompetitive practices and their inconsistency in regulating their app store. Apple also provides secret entitlements to chosen developers, while most other apps on the App Store are severely limited in capabilities compared to Apple’s apps. 

In the News: Instagram Kids development halted following widespread criticism

Yadullah Abidi

Yadullah Abidi

Yadullah is a Computer Science graduate who writes/edits/shoots/codes all things cybersecurity, gaming, and tech hardware. When he's not, he streams himself racing virtual cars. He's been writing and reporting on tech and cybersecurity with websites like Candid.Technology and MakeUseOf since 2018. You can contact him here: yadullahabidi@pm.me.

>