They thought that the politics of business certificates misused by developers of App store was it over? Because they found it wrong.
Lookout security analysts discovered yet another set of applications that misused certificates, and this time for even more problematic purposes: spying on users, collecting data such as calls, photos, locations, and more all as legitimate apps. of carriers.
The apps in question were distributed in Italy and in Turkmenistan, and were offered for download directly by Safari business certificates, as is well known, are used for apps to be installed outside the App Store, usually by employees of a company.
These apps, pretending to be carrier utilities, pretended to offer extra features to users' phone plans, but could basically capture all the data on the device and even record calls.
It is not known exactly who is behind the apps, but it is believed that there is an involvement of an Italian company called Connexxa, which previously created an Android surveillance app called Exodus that is currently used by the Italian government. Both apps use the same backend, which indicates that we are talking about the same creators.
O TechCrunch sent the Apple findings and the company repeated the standard statement that this type of use of the certificate violates its rules. The apps in question have already been rendered useless and the developer certificate revoked.
No one is surprised that after the discoveries regarding Google, Facebook, and porn and gaming apps, business certificates would continue to be misused. What is striking here is Apple's inertia: Is it not the case that the company has by now rethought the operation of these certificates? The current model, after all, is clearly not working.