Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Apple Targets App Store Bait And Switch Scammers

Apple will lock down app screenshots after approval to stem a spate of sellers hawking fake apps.

Apple iTunes 11: Visual Tour
Apple iTunes 11: Visual Tour
(click image for larger view and for slideshow)
Apple has revised its app-submission rules to help block scammers who submit an app for approval, then later upload fake screenshots or alter descriptions to make the software appear to be more fully featured than it really is, or even a clone of another, well-known app.

In a developer note titled "Updating Screenshots in iTunes Connect" posted Wednesday, Apple said that "app screenshots will be locked in iTunes Connect once your app has been approved," and that the change is effective immediately. "New screenshots may be uploaded when you submit a binary for an update to an existing app or a new app."

The change affects all book, music, TV show, movie and app sellers, across iTunes Direct, the App Store, iBookstore and Mac App Store.

Bait-and-switch scams are commonplace in the real world, for example in restaurants that advertise one type of wine but replace it with a cheaper substitute, or via emails that promise free iPads, but simply lead to endless online surveys. "But switching out an actual application in the iOS world is much harder, because Apple vets each app first, then digitally signs it and only then makes it available for download," said Paul Ducklin, head of technology for Sophos in the Asia Pacific region, in a blog post. "Nevertheless, you can still run a scam, even with vetted and digitally signed apps."

[ Successful crimeware toolkit author is going on a $100,000 vulnerability shopping spree. See Blackhole Botnet Creator Buys Up Zero Day Exploits. ]

Indeed, over the past year, multiple scammers have submitted an app to Apple, gotten it approved and then later altered the screenshots or listing details. In February, for example, scammers placed a clone of Nintendo's "Pokemon Yellow" game in the App Store. They sold an unknown number of copies before users complained and Apple yanked the application, reported iOS gaming site TouchArcade. The scammers knew their target market well: Nintendo doesn't sell any apps via the Apple App Store, which would have made the app immediately attractive to Pokemon fans.

The Pokemon app was completely non-functional, reported TouchArcade. Even so, "people have been scrambling over the thousand or so one-star reviews in order to give it a spin," it said at the time, noting that it quickly became the third most popular paid app. "Money is being made here, and it's the significant variety," said TouchArcade.

Another scam, meanwhile, involved Minecraft clones, including one titled "Mooncraft." Scammers apparently "used different screenshots to get past Apple reviewers, and then later changed the game information," substituting actual screenshots from the real Minecraft game, reported MacRumors. It noted that Apple, in the past, has reimbursed people who purchased scam apps.

Why scam iOS app buyers? Given the number of people who download iOS apps, attackers could arguably turn a quick profit. On the other hand, Apple only pays developers once per month, meaning that a successful scammer would have had to game not only Apple's app-approval process, but also payment timetable.

Still, those hurdles haven't deterred every would-be scammer, which led Ducklin to praise Apple's changes. "Looks like this particular bait-and-switch game is up. Good," he said. "Of course, one wonders why Apple, a company that is so punctilious about the actual software it lets into the App Store, hasn't enforced a corresponding precision in App Store advertising all along."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
1/21/2013 | 3:03:53 AM
re: Apple Targets App Store Bait And Switch Scammers
This seems like such a simple solution, why was this not thought of earlier before Apple accounts were compromised due to fake apps? There are way to many scams out there in the digital world for a consumer to not be weary of every purchase they make and how it will effect their digital world.

Paul Sprague
InformationWeek Contributor
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27254
PUBLISHED: 2021-03-05
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the apply_save.cgi endpoint. This issue results from the use of hard-coded encrypti...
CVE-2021-27255
PUBLISHED: 2021-03-05
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is not required to exploit this vulnerability. The specific flaw exists within the refresh_status.aspx endpoint. The issue results from a lack of...
CVE-2021-27256
PUBLISHED: 2021-03-05
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists wit...
CVE-2021-27257
PUBLISHED: 2021-03-05
This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via...
CVE-2021-26705
PUBLISHED: 2021-03-05
An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without authentication, the results of which can be used to generate valid authentication tokens. These tokens can then be used to invoke administrative tasks within the...