Forbes reports on Andy Miller, renowned security researcher, being kicked from the iOS Developer Program after getting a proof of concept into the App Store:
Miller had, admittedly, created a proof-of-concept application to demonstrate his security exploit, and even gotten Apple to approve it for distribution in Apple’s App Store by hiding it inside a fake stock ticker program, a trick that Apple wrote violated the developer agreement that forbid him to “hide, misrepresent or obscure” any part of his app. But the researcher for the security consultancy Accuvant argues that he was only trying to demonstrate a serious security issue with a harmless demo, and that revoking his developer rights is “heavy-handed” and counterproductive. “I’m mad,” he says. “I report bugs to them all the time. Being part of the developer program helps me do that. They’re hurting themselves, and making my life harder.”
The problem, I think, is not that he demonstrated the issue; I think it’s not even that he demonstrated that one could slip it by the App Store review team.
In my opinion Miller’s mistake was not taking the App down himself after he had demonstrated the exploit and caught it on video (at least the news reports didn’t indicate that to me). It would have still been against the rules, but there would have been no harm to Apple other than possibly bad publicity, and more importantly to no one other than Apple; Miller might have still been kicked from the developer program, but I would have understood his anger and disappointment in that case.
But he simply left the App for everyone to download – again, from what I understood from the news reports – and therefore put customers in potential harm (especially since the App was free). And at that point it doesn’t matter that he’s a security researcher and maybe more trustworthy than “no-name-developers” – if Apple made some members of the ecosystem more equal than others, everything would start to crumble. While I don’t think anyone, including Apple, thinks of Miller as someone abusing that situation to harm users, that doesn’t mean he should be treated special. Not only would the line that has to be drawn begin to become fuzzy, not only would it become only a matter of time that Apple misjudges and gave someone special treatment that didn’t deserve it; it would also – and probably more importantly – require the users to think about the Apps they download and who creates them, and that’s the one thing Apple doesn’t want and need.
And it’s not only about potentially putting customers in harms way. In Miller’s demonstration video he deploys a payload that changes the App’s behavior: On start, the App immediately quits again and instead sends the user to a website or YouTube-video. That in itself is enough to erode an inexperienced user’s trust and faith in the ecosystem; they become confused and wary of again installing an App – any App – because they don’t understand what’s going on and feel like they’re out of control.
So in all, it’s acceptable that Apple kicked Miller. They shouldn’t do it because he discovered and showed off a vulnerability, and had he done only that, I’d criticize Apple. However, by leaving it on the App Store, Miller didn’t act responsibly, and bringing forward the defense of “Apple should be thankful! I’m doing heir work for them”, he honestly seems a bit childish to me. Like a fed up child that can’t see why its parents won’t let them eat candy for breakfast.
And while I’m certainly not a security researcher, I also don’t think it’s common practice in that field either. There’s simply no reason why the App should be available on the App Store; no one can benefit from that course of action, but a lot of people and systems are being compromised. Remember: there is no insight to be gained by downloading the App; for one, there is no way to really understand the inner workings (only releasing the source code, not just an already compiled version thereof would provide one), and since this whole proof of concept is based in part on code that runs on Millers server not even other researchers (the only group of people that might have a reason other than pure curiosity to download the App) could gain any insight.
Also:
Miller chalks up the difference to Apple’s new management. “I miss Steve Jobs,” he says. “He never kicked me out of anything.”
I guess we’re starting to see the first cases of “It’s because Steve’s gone” being used as an explanation for everything “wrong” that happens at Apple, no matter how ridiculous it may sound.
