Google Researcher: Apple finally turns HTTPS on for the App Store


Google Researcher: Apple finally turns HTTPS on for the App Store

Elie Bursztein, a researcher at Google, is reporting that Apple only recently fixed a massive security loop hole on the AppStore.

“Early July 2012, I reported to Apple numerous vulnerabilities related to their App Store iOS app. Last week Apple finally issued a fix for it and turned on HTTPS for the App Store,” Elie Bursztein. “I am really happy that my spare-time work pushed Apple to finally enabled HTTPS to protect users. This post discuss the vulnerabilities I found. As a bonus, I made several video demos of the attacks described in this post so you can see by yourself how dangerous not having full HTTPS is.”

According to Bursztein, “the Apple App Store and associated applications, such as the Newsstand, are native applications provided by default with iOS to access/purchase content from the Apple App Store.”

“While the Apple App Store is a native iOS app, most of its active content, including app pages and the update page, is dynamically rendered from server data. The server data is mostly standard web data (HTML/Javascript/CSS) with custom extensions/keywords,” Burstein writes.

Here is a list of attacks Burstein believes could have been carried on the AppStore due to a lack of encryption (HTTPS):

  •  Password stealing: Trick the user into disclosing his or her password by using the application update notification mechanism to insert a fake prompt when the App Store is launched.
  •  App swapping: Force the user to install/buy the attacker’s app of choice instead of the one the user intended to install/buy. It is possible to swap a free app with a paid app.
  • App fake upgrade: Trick the user into installing/buying the attacker’s app of choice by inserting fake app upgrades, or manipulating existing app upgrades.
  • Preventing application installation: Prevent the user from installing/upgrading applications either by stripping the app out of the market or tricking the app into believing it is already installed.
  • Privacy leak: The App Store application update mechanism discloses in the clear the list of the applications installed on the device.

I assume Apple’s security guys are thinking, “better late than never.”


Posted by | Posted at March 9, 2013 17:29 | Tags: , , ,
Storm is a technology enthusiast, who resides in the UK. He enjoys reading and writing about technology.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Related Posts

Will Apple Develop a ChatGPT A.I. Competitor?

April 23, 2023
Apple has always been known for its innovative products, from...

The Latest Apple iPhone News: What to Expect in 2023

February 12, 2023
Apple Inc., the leading tech giant in the smartphone market,...

© 2023 THETECHSTORM. All Rights Reserved.