By removing VPNs from its Chinese App Store, Apple turns its biggest security asset against its users

Posted by   Martijn Grooten on   Aug 1, 2017

A little over a month ago, Apple's iPhone celebrated its tenth birthday. The iPhone has been one of the biggest commercial success stories ever, but it has also been a great success from a security point of view: malware targeting its iOS operating system remains extremely rare.

Malware for iOS is not completely non-existent: for example, at VB2014 a group of FireEye researchers presented a paper in which they demonstrated how the iOS Developer Enterprise Program could be used to install malware; something which was used shortly afterwards by WireLurker. However, in the rare cases iOS malware is found, it often requires the phone to be jailbroken; AdThief is a good example of that.

Apple dedicates a lot of resources to making its operating systems secure, but the main reason for the lack of malware is likely to be its tightly controlled App Store, which protects users against the biggest threat: themselves. Whether it is through opening malicious links sent via email or by installing free versions of paid-for apps, it is almost always a human mistake (understandable as they often are) that leads to an infection.

The App Store makes it almost impossible for such a mistake to lead to malware being installed. For this reason, iPhones are often recommended to those whose threat models include powerful adversaries, for example journalists and activists.

I was thus disappointed to learn that Apple has removed all VPN apps from its Chinese App Store. Though many VPN apps have issues themselves, they do offer extra protection against various threats – and not just the threat of the government finding out you're doing something they don't approve of.

I am aware that it is easy for me to criticize Apple: the company says it had no choice but to comply with Chinese law. Failing to do so could have jeopardized the company's Chinese market and thus could potentially have led to the job losses of thousands of Apple employees. The total removal of the iPhone from China wouldn't necessarily have made users better off.

Still, I would have liked for Apple to have taken a strong principled stand, like it did when the US government asked it to unlock the iPhone used by the San Bernardino shooter. Sadly, the company will soon have another opportunity to take such a stand: this weekend, Russian president Vladimir Putin signed a law that bans the use of VPNs in Russia.




Latest posts:

VB2017 paper: The life story of an IPT - Inept Persistent Threat actor

At VB2017 in Madrid, Polish security researcher and journalist Adam Haertlé presented a paper about a very inept persistent threat. Today, we publish both the paper and the recording of Adam's presentation.

Five reasons to submit a VB2018 paper this weekend

The call for papers for VB2018 closes on 18 March, and while we've already received many great submissions, we still want more! Here are five reasons why you should submit a paper this weekend.

First partners of VB2018 announced

We are excited to announce the first six companies to partner with VB2018.

VB2018: looking for technical and non-technical talks

We like to pick good, solid technical talks for the VB conference programme, but good talks don't have to be technical and we welcome less technical submissions just as much.

Partner with VB2018 for extra visibility among industry peers

Partnering with the VB conference links your company to a successful and well-established event, demonstrates your commitment to moving the industry forward, allows you to meet potential clients, be visible to industry peers and build lasting…