Hacker News Reader

Comment by AdmiralAsshat | Hacker News Reader

I glanced at the report, but I'm not seeing much on how these devices get compromised.

Let's say I'm a targeted individual with an iPhone or an Android phone. I've already got Signal installed through the app store, which should be vetting the apps I download. How does my legitimate Signal app get replaced with an infected one?

View on HN

iPhone users aren't targeted. It's difficult to install trojaned Signal on an iPhone, since you can't sideload them from random websites.

You're infected by being phished to a staging server that looks like a legitimate launcher/installer site for secure messengers; that site delivers Android Java applications for WhatsApp, Signal, &c, but those applications are backdoored to ask for all possible permissions and to quietly set up a C&C channel back to the operators.

It’s not really that difficult. Just create a clone app, pass the initial store review, then change the icon/description to be close to the official app in an update, and opt out of AppStore search, so that it can only be accessed through a link. It’s just that the payoff is much less impressive than on Android.. although, I guess, you can always try to sneak in a VPN entitlement, and hope the reviewer is extra incompetent that day..

That assumes that Apple hasn't automated the process of hunting those particular targeted applications out, which is not a safe assumption anymore.

To be fair: I'm pretty certain Google also automates detection of this stuff. The problem with Android is sideloading. Apple was right about this.

> Apple was right about this.

I hate it when Apple is right. And I hate that their golden numerical prison has genuine advantages over the alternatives.

Assuming users cannot be fixed, what can? Users sideload apps from the web, right? Can't there be an easy way to distinguish trustworthy communications from potentially dangerous ones? Would such a way be systematically worked around by ever cleverer phishers?

With great power comes great responsibility. There is no way to give users more power without also giving them more responsibility.

Making side loading opt-in and warning users of the security risks seems like a better compromise to me than requiring that every app on my phone is vetted by a single gatekeeper.

"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." and all that.

> requiring that every app on my phone is vetted by a single gatekeeper.

What are you referring to here?

I just installed an SNES emulator on my iPhone without jailbreaking and without paying Apple for a developer account. I don't think Apple knows anything about the app.

Apple is well aware of the rogue Enterprise certificates used for those.

They also probably do not care much about those which you can sign with your Apple ID, as it is bound to your specific device UDID.

I didn't use a "rogue Enterprise certificate".

Both methods work.

> That assumes that Apple hasn't automated the process of hunting those particular targeted applications out, which is not a safe assumption anymore.

I am quite certain they do. When clone apps pop up in the App Store, they are removed very quickly.

The EFF report specifically said they don't ask for more permissions. They just chose apps with good permissions already. Most of the scary stuff in the report is from actual Windows desktop trojans. The mobile stuff is just plain repack.

The largest infection vector for Signal are people that don’t use the Play Store. (Well, used to be).

For a long time, Moxie refused to offer it on any other store, or official APK downloads, so users then just googled for it, and downloaded the first result.

Whenever you make it hard to do something securely, users will find a way around that. And that will usually break all your security precautions.

> It's difficult to install trojaned Signal on an iPhone, since you can't sideload them from random websites.

FWIW, you definitely can do this (you go to a webpage and it asks you to install a product) with an "enterprise" certificate, but the idea (true or not) is that Apple then knows who the developer is; so, so if you someone noticed and reports them, Apple is supposed to be able to do something about it (again, that's the theory).

I thought it was interesting that the reports mentions some devices are compromised at the phone repair shop right after being repaired.

Reply on news.ycombinator.com