A group of researchers from Georgia Tech managed to get a malicious app past Apple's review process, finding the company may run only a few seconds' worth of tests before posting an app to the App Store.
Dubbed "Jekyll," the malicious software was uploaded to Apple's App Store in March to test the company's control measures, which dictate what apps are allowed to be distributed through the App Store, reports MIT's Technology Review.
According to the research team responsible for creating the software, Apple was unable to distinguish dormant bits of code that would later be assembled into a malicious app. Once installed on a victim's device, Jekyll, disguised as a news delivery app, was able to post tweets, send email and text messages, access the phone's address book, take pictures, and direct Safari to a malicious website, among other nefarious actions.
“The app did a phone-home when it was installed, asking for commands," said Stony Brook University researcher Long Lu. "This gave us the ability to generate new behavior of the logic of that app which was nonexistent when it was installed.â€
Jekyll also had code built in that allowed the researchers to monitor Apple's testing process, which reportedly only ran the app for "a few seconds" before letting it go live on the App Store. Lu said the Georgia Tech team deployed Jekyll for only a few minutes, downloading and pointing the app toward themselves for testing. No consumers installed the app before it was ultimately taken down as a safety precaution.
“The message we want to deliver is that right now, the Apple review process is mostly doing a static analysis of the app, which we say is not sufficient because dynamically generated logic cannot be very easily seen,†Lu said.
The research team wrote up its results in a paper that was scheduled for presentation on Friday at the Usenix conference in Washington, D.C.
Apple spokesman Tom Neumayr said the company took the research into consideration and has updated iOS to deal with the issues outlined in the paper. The exact specifics of these fixes were not disclosed, and no comment was made on the App Store review process.