Roger Fingas
An impostor app pretending to belong to MyEtherWallet.com has been removed from the App Store, but not before it managed to secure an ad and climb to third place in the store's Finance category over the weekend.
The developers behind the genuine MyEtherWallet called attention to the scam on Sunday, saying they were reporting the app in a bid to get it removed, according to TechCrunch. The fake title's creator was listed as "Nam Le," a person with three other iOS apps, but nothing involving cryptocurrency.
The app cost $4.99, and was on the App Store for a little over a week. It promised to let people create or import a wallet for cryptocurrencies, saving keys on-device — a risky proposition with an unknown developer, who could've theoretically harvested the data. At least 3,000 downloads were made.
The fake software was moreover attempting to monetize a free open-source platform, which is frowned on in industry circles.
Cryptocurrencies such as Bitcoin and Ethereum have exploded in popularity during 2017, and even more so in the past few weeks. At the moment, a single bitcoin is worth over $16,000 — helped by the start of futures trading.
Apple periodically deals with fake apps, but is normally able to catch them during the review process or before they achieve any real popularity.
Christine McKee
Malcolm Owen
Sponsored Content
Amber Neely
1 Comment
On the surface this sounds rather troubling. It sounds like someone left one of the gates open on the walled garden. I would imagine that Apple has some sort of instrumented super sandbox that it can use to analyze the behavior of Apps in a controlled environment that the app-under-test thinks is a real device, operating system, and connected Internet but is in reality a digital twin that has all of the app's interactions passively monitored, logged, and analyzed. Of course this still wouldn't be able to crack into cryptographically protected information (payloads) but it would be able to do behavioral analysis and deep packet inspection of operating system calls that Apple provides on the device and on standard communication protocols. For example, making sure Apps don't have revoke countermeasures in place by revoking the App in the sandbox.
All this talk about AI, AR, and machine learning makes me think Apple ought to be applying some of this technical wizardry to its App testing and approval processes as well as periodically monitoring Apps even after they've been approved.