Did you find that the controversy over business certificates improperly used by App Store developers was over? Because they thought wrong.
Lookout security analysts found yet another set of applications that used the certificates inappropriately, and this time with even more problematic purposes: spying on users, collecting data such as calls, photos, locations, and more – all of which passed as apps operators.
The apps in question were distributed in Italy and Turkmenistan and were offered for download directly from Safari – business certificates, as we all know, are used to get apps installed outside of the App Store, usually by employees of a company.
These applications, ranging from carrier utilities, pretended to offer extra features to users’ telephony plans, but could basically capture all data from the device and even record calls.
It is not known exactly who is behind the apps, but it is believed that there is an involvement of an Italian company called Connexxa, which previously created an Android surveillance application – called Exodus – that is currently used by the Italian government. Both apps use the same backend, which indicates that we are talking about the same creators.
The TechCrunch sent the findings to Apple and the company repeated the standard statement that this type of certificate of use is a violation of their rules. The apps in question have already been disabled and the developer certificate has been revoked.
No one is surprised that after the findings on Google, Facebook, and the gaming and porn apps, business certificates continued to be misused. What draws attention here is the inertia of Apple: would not it be the case that, by now, the company has already rethought the operation of these certificates? The current model, after all, is clearly not working.
