Flash in the Pants, Tablets & Apple TVs
18.05.12
, &Ldquo;the app gets downloaded from the App Store as any other free or paid app. The first time Miller runs it on his iPhone, nothing happens and the app performs as advertised. But as soon as Miller activates the hidden functionalities on his web server, somehow connected to the iOS app, the app ‘phones home’ and starts downloading and executing unsigned code.”
The piece says Miller was able to vibrate the phone remotely, open a YouTube video, and download the device’s entire Address Book remotely. “The app is seen exposing parts of the iOS filesystem,” according to the piece, “listing installed apps, and presumably giving access to a user’s documents, photos and more.”
Apple has since pulled the app from the App Store and has booted Miller from the iOS developer program.
While one could argue that Miller should never have submitted the app, even if it was to prove a point, he argues in a MacNN piece that “without a real app in the App Store, people would say Apple wouldn’t approve an app that took advantage of this flaw.”
Source: The Mac Observer