Another pirated app service uses Apple enterprise license to distribute stolen software

article thumbnail

Word of a fairly well known pirated app service called vShare hit mainstream media outlets on Wednesday as part of a CNNMoney feature, which said the nefarious firm leverages Apple's own enterprise tools to distribute free versions of top paid iOS titles without requiring a jailbreak.

Thought to be run by Chinese owners located in Shanghai, the vShare App Market has officially been in operation since 2011 and is recognized in some jailbreaking circles as a go-to source for free apps. The service recently gained notoriety for compatibility with non-jailbroken iPhones and iPads running iOS 8 and above.

Like other recent pirated app services, vShare is built on Apple's enterprise licensing technology. Designed for corporations or other entities with large iOS device deployments, Apple Developer Enterprise certificates allow license holders to provision their own apps for internal distribution and download.

In the case of vShare, the service used purchased certificates to create a trusted app, available for download via the Web, that acts as a its own illegitimate app store. Security researchers at Proofpoint told CNNMoney that vShare obtained four Apple Developer Enterprise certificates to accomplish the task. Proofpoint has informed Apple of its findings.

As of this writing, attempts to install the vShare app on devices running iOS 8 or iOS 9 proved unsuccessful, suggesting Apple has revoked one or all of vShare's provisioned certificates.

vShare's impact on legitimate app sales is unknown, but today's report notes popular titles like Minecraft: Pocket Edition and Geometry Dash have been "liked" by more than 1.4 million downloaders.

Interestingly, vShare's terms of use includes a disclaimer regarding intellectual property rights, which notes the service will remove any app found to be in infringement of owned properties if provided with appropriate documentation. The terms also state, however, that vShare "assumes no responsibility for monitoring the Service."


Latest News