By removing VPNs from its Chinese App Store, Apple turns its biggest security asset against its users

Posted by   Martijn Grooten on   Aug 1, 2017

A little over a month ago, Apple's iPhone celebrated its tenth birthday. The iPhone has been one of the biggest commercial success stories ever, but it has also been a great success from a security point of view: malware targeting its iOS operating system remains extremely rare.


Malware for iOS is not completely non-existent: for example, at VB2014 a group of FireEye researchers presented a paper in which they demonstrated how the iOS Developer Enterprise Program could be used to install malware; something which was used shortly afterwards by WireLurker. However, in the rare cases iOS malware is found, it often requires the phone to be jailbroken; AdThief is a good example of that.

Apple dedicates a lot of resources to making its operating systems secure, but the main reason for the lack of malware is likely to be its tightly controlled App Store, which protects users against the biggest threat: themselves. Whether it is through opening malicious links sent via email or by installing free versions of paid-for apps, it is almost always a human mistake (understandable as they often are) that leads to an infection.

The App Store makes it almost impossible for such a mistake to lead to malware being installed. For this reason, iPhones are often recommended to those whose threat models include powerful adversaries, for example journalists and activists.

I was thus disappointed to learn that Apple has removed all VPN apps from its Chinese App Store. Though many VPN apps have issues themselves, they do offer extra protection against various threats – and not just the threat of the government finding out you're doing something they don't approve of.

I am aware that it is easy for me to criticize Apple: the company says it had no choice but to comply with Chinese law. Failing to do so could have jeopardized the company's Chinese market and thus could potentially have led to the job losses of thousands of Apple employees. The total removal of the iPhone from China wouldn't necessarily have made users better off.

Still, I would have liked for Apple to have taken a strong principled stand, like it did when the US government asked it to unlock the iPhone used by the San Bernardino shooter. Sadly, the company will soon have another opportunity to take such a stand: this weekend, Russian president Vladimir Putin signed a law that bans the use of VPNs in Russia.

 

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Didn't come to VB2017? Tell us why!

Virus Bulletin is a company - and a conference - with a mission: to further the research in and facilitate the fight against digital threats. To help us in this mission, we want to hear from those who didn't come to Madrid. What is your impression of…

Montreal will host VB2018

Last week, we announced the full details of VB2018, which will take place 3-5 October 2018 at the Fairmont The Queen Elizabeth hotel in Montreal, Quebec, Canada.

VB2017 preview: Beyond lexical and PDNS (guest blog)

In a special guest blog post, VB2017 Silver sponsor Cisco Umbrella writes about a paper that researchers Dhia Mahjoub and David Rodriguez will present at the conference this Friday.

Avast to present technical details of CCleaner hack at VB2017

The recently discovered malicious CCleaner version has become one of the biggest security stories of 2017. Two researchers from Avast, the company that had recently acquired CCleaner developer Piriform, will share the results of their investigations…

VB2017 preview: Walking in your enemy's shadow: when fourth-party collection becomes attribution hell

We preview the VB2017 paper by Kaspersky Lab researchers Juan Andrés Guerrero-Saade and Costin Raiu on fourth-party collection and its implications for attack attribution.