Another pirated app service uses Apple enterprise license to distribute stolen software

Word of a fairly well known pirated app service called vShare hit mainstream media outlets on Wednesday as part of a CNNMoney feature, which said the nefarious firm leverages Apple's own enterprise tools to distribute free versions of top paid iOS titles without requiring a jailbreak.

Thought to be run by Chinese owners located in Shanghai, the vShare App Market has officially been in operation since 2011 and is recognized in some jailbreaking circles as a go-to source for free apps. The service recently gained notoriety for compatibility with non-jailbroken iPhones and iPads running iOS 8 and above.

Like other recent pirated app services, vShare is built on Apple's enterprise licensing technology. Designed for corporations or other entities with large iOS device deployments, Apple Developer Enterprise certificates allow license holders to provision their own apps for internal distribution and download.

In the case of vShare, the service used purchased certificates to create a trusted app, available for download via the Web, that acts as a its own illegitimate app store. Security researchers at Proofpoint told CNNMoney that vShare obtained four Apple Developer Enterprise certificates to accomplish the task. Proofpoint has informed Apple of its findings.

As of this writing, attempts to install the vShare app on devices running iOS 8 or iOS 9 proved unsuccessful, suggesting Apple has revoked one or all of vShare's provisioned certificates.

vShare's impact on legitimate app sales is unknown, but today's report notes popular titles like Minecraft: Pocket Edition and Geometry Dash have been "liked" by more than 1.4 million downloaders.

Interestingly, vShare's terms of use includes a disclaimer regarding intellectual property rights, which notes the service will remove any app found to be in infringement of owned properties if provided with appropriate documentation. The terms also state, however, that vShare "assumes no responsibility for monitoring the Service."

25 Comments

thewhitefalcon 4444 comments · 10 Years

About 8 years ago

Glad to see its been blocked. Disgusting thieves.

ericthehalfbee 4489 comments · 13 Years

This is such a ridiculous method to try and distribute Apps. Apple can revoke enterprise certificates immediately upon discovering them effectively shutting down the service.

How would a site get word out to potential customers to download Apps without word getting back to Apple about a certificate being abused?

macky the macky 4801 comments · 15 Years

ericthehalfbee said:

This is such a ridiculous method to try and distribute Apps. Apple can revoke enterprise certificates immediately upon discovering them effectively shutting down the service.

How would a site get word out to potential customers to download Apps without word getting back to Apple about a certificate being abused?

It apparently is far more successful for Android and Windows apps. If the site is more familiar to the Asian users, there seems to be no awareness of the dangers of malware with "free" software in those cultures.

cropr 1142 comments · 11 Years

One should never use a different app store, it can only lead to trouble, malware and other security issues. I don't understand that people want to go that way. Even on Android where a single app store is not enforced, it is a bad idea to use an alternative app store.

macky the macky said:

ericthehalfbee said:

This is such a ridiculous method to try and distribute Apps. Apple can revoke enterprise certificates immediately upon discovering them effectively shutting down the service.

How would a site get word out to potential customers to download Apps without word getting back to Apple about a certificate being abused?

It apparently is far more successful for Android and Windows apps. If the site is more familiar to the Asian users, there seems to be no awareness of the dangers of malware with "free" software in those cultures.

True about third party stores.

But I don't believe anyone is actually using enterprise certificates to distribute malware. I think they are all just proof of concepts drummed up to make it appear Apple has a malware problem.

You have to register as an enterprise developer with Apple and this costs $299 per year. And you don't just sign up with a credit card and get approved. You have to verify you're an actual company (legal entity).

As soon as Apple discovers a certificate is being abused they revoke it (as evidenced by this article where it didn't work when they tried it). I'm not sure what Apple does internally, but you can bet they don't just revoke it and let it go. The company and/or people and/or IP addresses involved are probably blacklisted so they can't come back and get another certificate later on.

In short, this is nothing more than scare mongering/Apple bashing. There's little to no chance you'll ever come across a working enterprise certificate in the wild.