Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Users No Longer Need to Jailbreak Apple iOS To Load Rogue Apps
Threaded  |  Newest First  |  Oldest First
RyanSepe
RyanSepe,
User Rank: Ninja
12/30/2015 | 10:33:18 AM
Vetting Process?
How are these enterprise certificates provided? I would imagine by Apple but is there a stringent vetting process in place to provide these certs to an enterprise? This article would make me believe there is not.
melgross
melgross,
User Rank: Apprentice
12/30/2015 | 10:51:08 AM
Re: Vetting Process?
I just hope that when people using these, and other unapproved stores, get malware, they blame themselves, rather than Apple. There is a very good reason why iOS is so secure from malware, as opposed to Android. That is, other than the poor way that Android itself was written.
WCLoehr
WCLoehr,
User Rank: Strategist
12/30/2015 | 6:21:42 PM
Re: Vetting Process?
Let's say your company is Acme, Inc. and you develop apps. you apply to Apple for an enterpise cert so your Acme employees can use it for installing "enterprise approved" apps. What then prevents you from using that for others? Outside of the agreement you accepted when getting the cert from Apple...nothing. There probably is little monitoring of how pwoplw are using these certs once they get them, see no eveil, hear no eveil, perhaps? At this point, its hard to say whether Apple should be doing more, but my bet would be they have a process deficiency that needs to be solved now.
ZucchiniW940
ZucchiniW940,
User Rank: Apprentice
1/6/2016 | 3:28:57 AM
Re: Vetting Process?
The people operating these marketplaces are criminals.  They have elaborate schemes to pay people to impersonate companies and fraudulently obtain enterprise distributions certificates.  Our research shows that companies in China and the United Arab Emirates have been faked, and those identities used to get around Apple's vetting process.  

 

Dave

Proofpoint

 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-0240
PUBLISHED: 2023-01-30
There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will u...
CVE-2023-0266
PUBLISHED: 2023-01-30
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_WRITE32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b...
CVE-2022-45788
PUBLISHED: 2023-01-30
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxureâ„&cent...
CVE-2022-38451
PUBLISHED: 2023-01-30
A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2022-42484
PUBLISHED: 2023-01-30
An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.