Apple has finally fixed a vulnerability that was alerted about 6 six month back. This vulnerability was found in the iOS app store by Google. But, the interesting fact of the app was that it was reported by the Google’s security researcher, Elie Bursztein, but Apple doesn’t responded to it. This vulnerability could have been exploited over any public WIFI network and according to the security researcher can carry out following destruction:
- Password stealing: Trick the user into disclosing his or her password by using the application update notification mechanism to insert a fake prompt when the App Store is launched.
- App swapping: Force the user to install/buy the attacker’s app of choice instead of the one the user intended to install/buy. It is possible to swap a free app with a paid app.
- App fake upgrade: Trick the user into installing/buying the attacker’s app of choice by inserting fake app upgrades, or manipulating existing app upgrades.
- Preventing application installation: Prevent the user from installing/upgrading applications either by stripping the app out of the market or tricking the app into believing it is already installed.
- Privacy leak: The App Store application update mechanism discloses in the clear the list of the applications installed on the device”.
According to the Bursztein, this vulnerability was generated due to lack of HTTPS encryption in the App store. Now, Apple has applied more HTTPS encryption into the store.
But, the most horrifying fact of this vulnerability was the delay made by Apple inc. They even didn’t notify their iOS users about this vulnerability They could have easily fixed this vulnerability long time ago, but they didn’t was questionable and still a mystery for all tech-masters.
Follow @HackRead
