159
First ever iOS trojan discovered — and it’s stealing Face ID data to break into bank accounts
(www.tomsguide.com)
this post was submitted on 15 Feb 2024
159 points (93.9% liked)
Apple
19011 readers
89 users here now
Welcome
to the largest Apple community on Lemmy. This is the place where we talk about everything Apple, from iOS to the exciting upcoming Apple Vision Pro. Feel free to join the discussion!
Rules:
- No NSFW Content
- No Hate Speech or Personal Attacks
- No Ads / Spamming
Self promotion is only allowed in the pinned monthly thread
Communities of Interest:
Apple Hardware
Apple TV
Apple Watch
iPad
iPhone
Mac
Vintage Apple
Apple Software
iOS
iPadOS
macOS
tvOS
watchOS
Shortcuts
Xcode
Community banner courtesy of u/Antsomnia.
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
MFA or not, you can always social engineer people into getting access into their bank account. There's even SS7 attack for SMS based MFA. So, let's just abolish passwords and MFA all together and everyone hold hands to sing Kumbaya and be hippies together.... right? No, of course not. You do not weaken an established system because there's ways for bad actors to act maliciously. Vast majority of Apple users doesn't care for side loading and would benefit from the security that comes with the walled garden, very few Apple users (and the Lemmy user base does not a represent a statistically significantly broad representation of the user base) knows enough to care for otherwise, but are now getting dragged along for the ride.
There are plenty of apps people are forced to install; apps used for international airport entries, apps that’s used by everyone professionally, or worse yet, that one state-owned chat app grandma uses back home because everyone else uses it around her. All it take is one of them deciding they don’t want to be part of the strict review process and that their ability to further spy on their users are worth the core technology fee, and now people would be forced to use third party app stores with questionable review process. The “scare screen” before they add the third party App Store? That’s just going to be another thing users blindly click through due to notification fatigue.
At least for the time being, the current proposal put forth, Apple should still theoretically be able to revoke apps from third party app stores, and they still retain entitlement (sandbox/low level hardware access) signing rights. Once those checks and balances are taken away… then all hell breaks loose and those not super tech savvy (read: 99%+) will be hurt the most. At least I am comfortable enough to look out for myself 🤷
Because Google already lets apps do anything they want no matter how malicious. There's no reason to leave the Play Store.
Apple has people sneak past their rules on occasion because screening is hard, but they have and enforce rules that protect your privacy that malware companies like Facebook don't want to follow.
I'm not talking about permissions.
I'm talking about their store policies. Google is far more permissive about malicious behavior than Apple is. Companies that have no reason to bypass the play store because it already allows them to spy to an obscene degree will bypass the App Store when given the opportunity, because it does not.
Facebook can and will.
The entire reason they don't on Android is because there's literally no benefit to it.
It absolutely has happened on Android. The Russian government has launched their own app store, as an example of a state-owned-and-operated third party app store.
Additionally, once both iOS and Android are opened up, the capability to control the end-to-end distribution on both platforms simultaneously becomes a much larger incentive for major corporations; gone are the days where some users receives some features earlier because the other app store have not pushed the update yet -- they control it end-to-end.
I mean, I should be abundantly clear: simply operating a third party store does not equate to malicious intent. Some would argue the corporation case above could be considered beneficial for users. However, having third party stores with varying degree of security capabilities increases attack vectors for bad actors, and thereby making it more difficult for everyday users to manage -- an additional layer of complexity iOS users have not had to deal with for many years and very very few has signed up for.
Let's park the specific geopolitical powers for a moment, because I cannot speak on behalf of countries and their intentions.
People are inherently different, and have different mindsets and believes. You and I clearly don't fully agree on whether or not iOS App Store should be opened up for example; and while our lack of alignments are fairly benign, there will always be entities on different ends of our own individual biased points of views. Some of these are relatively minor (like the App Store), others are far more significant (like privacy concerns). There are plenty of world powers that would prefer to have access to more private information, and they are, as of today, without third party App Stores, having a much harder time doing such on the Apple iOS ecosystem. This is because in order to run anything, you'd have to get through Apple's stringent review process, and while there are plenty of terrible things we'd like to see gone from the App Store, they've got years of experience in heuristic detection, are generally fairly good about detecting malicious apps, and can revoke notarization when something does slip through.
Now, a hypothetical world power with drastic different view than you or I (and we don't even have to agree with each other here) could start their own third party App Store, and bypass a lot of the checks and balances currently in place. "Don't install that app store, and don't install apps from it" is not an answer if they are in a position of power over you for whatever reason. I've called out a couple; maybe you need to pass through their country and their travel authorization at their airport is done via an app distributed only through their own app store; maybe you have family residing in such an area, and their only way to communicate with you is through a chat app through such an app store; etc. etc.
That is the problem this opens up. And while government entities have a lot of surveillance capability, they're not having a lot of success with modern day end-to-end encryption, which is why there's continuous legislative attempts against encryption while hiding behind the guise of child protection / anti-terrorism / national security / etc. etc., and the demand is often to have government known backdoors in the encryption -- I trust you're savvy enough to know how absurd that sounds that we don't need to go into detail here.
Everything that's came to light so far seems to create a net negative experience for vast majority of iOS users -- third party stores that peels away layers of security and losing ability to use PWA are just two casualties we've became aware of so far. The gong show will likely continue and we'll just have to wait to see what else comes to light as it further plays out.