It’s a sad tale, but it’s one we should probably tell you. Both so we can make fun of the security expert who had his developer account deleted, and so we can make sure you’re one-hundred percent aware of the situation this guy created, then bragged about, then decided to complain about publicly on Twitter.
This tale isn’t a story of a poor developer who was slighted by that big Draconian Apple; instead, it’s a story of someone doing something they knew was wrong, and then getting busted for it.
Charlie Miller, a security expert who found a loophole in iOS, has had his developer account annihilated by Apple because, in his words, “they give researcher’s access to developer programs, (although I paid for mine) then they kick them out.. for doing research.”
Apple has given researchers access to “research” accounts so they can test security issues, and other things like that, but it seems that Charlie Miller was rocking his exploits from a regular old developer account. That was probably his first mistake, and it’s probably why Apple immediately moved to ban the account.
OMG, Apple just kicked me out of the iOS Developer program. That’s so rude!
In our words? Miller uploaded an exploit to the App Store, as a proof of concept, so he could, well, prove the concept. The app, InstaStock, would phone home to one of Miller’s servers, grab some code, and then run it on the user’s device. Yup, you read that right. He knowingly uploaded software that could compromise your device. Sure, it was a proof of concept, and there was probably never much of a likelihood that he would exploit your phone, but what was Apple supposed to do? Take his word for it?
Sections 3.2 and 6.1 of the iOS Developer Program License Agreement clearly prohibit the kind of behavior that Charlie Miller illustrated, so Apple kick-banned him in a way that would make that Banhammer guy smile a little bit.
In talking to CNET, Miller said:
I don’t think they’ve ever done this to another researcher. Then again, no researcher has ever looked into the security of their App Store. And after this, I imagine no other ones ever will,” Miller said in an e-mail to CNET. “That is the really bad news from their decision.
How is this bad news? Should Apple’s App Store be put through the security paces? Sure. But should “researchers” be allowed to exploit anything they feel like so they can talk about it and let others know? That’s the real question here. Perhaps the better approach would have been to call up Apple and tell them what he found. Turn over his code, and let them patch it, or figure out a solution.
This could be a case of a junior executive making a judgement call, and Miller’s account could be reinstated, but we won’t know until we hear back from Apple.
FLICKR
YOUTUBE
RSS
So, Apple's answer to a major security flaw is to sweep it under the rug?
- spam
- offensive
- disagree
- off topic
LikeDeleting the app and the personal account of someone who exploited their system isn't sweeping it under the rug. It's removing the threat, which is good practice. I should also reiterate that Miller has a research account that Apple both knows about, and encourages them to use to find exploits. He did this under a personal account, not the account set up to do these things, which may the reason Apple was swift in deleting the account.
- spam
- offensive
- disagree
- off topic
Like"Perhaps the better approach would have been to call up Apple and tell them what he found. Turn over his code, and let them patch it, or figure out a solution."
He informed them 3 weeks ago.
- spam
- offensive
- disagree
- off topic
LikeHe should be using his research account, not a personal one. I'd be the outcome would have been different had he stuck within the rules Apple set out for him
- spam
- offensive
- disagree
- off topic
LikeHey joshua
I dont understand how your arguements could be this one-sided... This is just the newest in a wave of PR mistakes apple has made towards apple-supporting programmers, tweakers and hobbyist
'Perhaps the better approach would have been to call up Apple and tell them what he found. Turn over his code, and let them patch it, or figure out a solution.'
This is exactly what the man did... He was waiting to go public whith the leak until apple had the chance to patch it..
If you want to disprove this please post a link where MR. Miller describes the SPECIFIC method he used to circumvent the Security measures of the app store, I think you would be hard-pressed to do so..
also there was no other way to test his theorem, as there is no way to simulate the app store security measures...
Posting that you found a security hole like this removes the (obviously false) impression that their app store is 100% safe,
Apple (like most multi-million dollar businesses) doesn't like bad rep so they took the high road and painted him the bad guy.
This is the real reason they suspended his account like this
ps: I got some info that it could've been a backdoor for a certain nefarious agency...
And no... I am not posting my source, look it up for yourself
- spam
- offensive
- disagree
- off topic
LikeHA-ha!
"I broke the rules and got punished, that's so unfair!"
- spam
- offensive
- disagree
- off topic
LikeYour'e comment shows your lack of information.. Security research exist on both sides, good and the bad, take it or leave it.. luckily Miller which were on the good side was THE leading apple security researcher (he's l33t at that shit!).. He always made sure that apple was the first to know, yes and this time too.. His exploit was only a proof of concept, both that apple blindly would upload crap to their app-store without even looking at it, secondly the software took advantage of a option available for the safari browser (safari "dedicates" some memory for running apps on the internet, to keep potential internet malware "out of touch" with the system memory) his app did the exact same thing, but with one difference; to run non-digitally signed software on the piece of memory which were "out of touch" with system memory. his app was only a proof of concept, like all his hacks (read about Millers MacBook battery hack and you'd be scared, that's of course if you own a mac) just be glad that he's one of the good guys! Even if he resigns as an apple security researcher or that he decides to sell his work to the bad side (well that's even perfectly legal). Either way seems pretty bad to apple now, because now the good side of apple probably lost their best security researcher. Even if he keeps being a good apple guy he's now severely handicapped at detecting security flaws in apple equipment, and now the bad side has better chance to get ahead, understand?
btw, after this treatment I would gladly download that InstaApp :-) Miller can steal CPU time frome me any day, if he just promise it's for cracking apple! Shame on you apple.. I certainly don't think SJ would even have treated Miller this way!
- spam
- offensive
- disagree
- off topic
LikeI understand the potential implications for Apple very well.
But let me ask you this:
Did he not use a regular developer account to upload the app?
Did he not "smuggle" an app into the AppStore that violates the terms of service and the developer agreement?
I'm not discounting his work and I'm thankful for it, but he broke the rules knowingly, just because he thought—not knew—Apple was ignoring the issue. At this point both Apple and Miller are at fault: Apple because of their shitty communication practices when it comes to this sort of thing, and Miller because he didn't get the attention he thought he and "his exploit" deserved.
What happened was what would happen to any other developer who violated the agreement between him and Apple.
I'm not sure where you're taking the knowledge about how Jobs would've handled the situation from, but maybe you know more about the man than I do.
- spam
- offensive
- disagree
- off topic
Like