Apple Developer Program Co-opted to Install Pirated iPhone Apps

Apple has traditionally kept is smartphones locked down to prevent unauthorized app installs, but there is a program that helps companies test and distribute non-public apps. It appears that some clever and unscrupulous folks on the internet have co-opted that technology to provide hacked and pirated apps. Apple, understandably, is not pleased.

When using an iOS device, you can usually only download apps from the App Store. Some users resort to complicated and dangerous hacks to “jailbreak” phones to unlock more capabilities, but that’s harder than it used to be. Shady app marketplaces like TutuApp, Panda Helper, AppValley, and TweakBox make use of Apple’s enterprise developer certificates to get around that.

If that sounds familiar, it’s because Apple’s certificate program was in the spotlight recently thanks to Facebook and Google. Both companies were found to be using enterprise developer certificates to install powerful traffic analysis apps on the phones of volunteer customers. This was a violation of Apple’s policies, so both companies had to end the practice. That prompted Reuters to look for other evidence of misuse, which it found in the above app repositories.

All the above app providers advertise the availability of paid apps and games for free, as well as hacked/modded content. iDevice users are invited to install the store’s certificate, which allows the client to push apps outside the App Store. A stolen version of Minecraft or Facetune would never pass muster in the App Store, but TweakBox or Panda Helper can do whatever they want in their own little ecosystem. The stores also offer free-to-play and ad-supported content with mods that strip out the monetization.

Many of these underground app marketplaces have their own ads to make money, and a few offer paid subscriptions with access to exclusive hacked content and other perks. All of them are siphoning off money from Apple and independent developers, though.

Apple can’t control what developers do with the enterprise certificates, but it can revoke them. That’s what it did (briefly) with Facebook and Google when they were caught misusing the program. When reached for comment, Apple said it’s ready to take immediate action. Canceling a certificate immediately suspends all apps installed via that certificate. At least one of the app provides cited in the Reuters report has already gone offline.

Even if you don’t care about the ethical angle, giving any of these services access to your device is a bad idea from a security standpoint. There’s no telling what’s lurking in these hacked apps.

Continue reading

Google Told Stadia Developers They Were Making ‘Great Progress,’ Then Fired Them

Google told its Stadia developers they were making "great progress." Then it fired them, less than a week later.

Pentagon May Dump $10 Billion JEDI Program Over Microsoft, Amazon Fight

The government is so tired of fighting with Amazon over the $10 billion JEDI cloud contract that went to Microsoft, it'd rather just quit than move forward with litigation.

iFixit: Samsung ‘Ruined’ Its Smartphone Upcycling Program

Samsung just dipped its toe in the waters of upcycling, but iFixit says Samsung lost its nerve, and that the original version of Galaxy Upcycling was going to be much more ambitious and useful.

Microsoft Kicks Unsupported PCs From Windows 11 Testing Program

As the October launch date for Windows 11 grows closer, Microsoft is standing firm on the new software's spec requirements. In fact, anyone running the beta on unacceptable hardware is being booted from the program, and their only option is to accept defeat and reinstall Windows 10.