Featured Post by Mike Rundle »

How To Scare The Hell Out Of iPhone Users

I was talking to some people today and came up with a scenario that I think is a real issue, one that would be difficult for Apple to stop.

Here’s a scenario:

A fun game is released to the iPhone App Store and it’s free. When you finish your game, it asks you if you want to publish your high score to the Internet. You choose “yes”. While it sends your score, it also sends your entire contact list up to a web server to be sold to spammers.

Think it can’t happen? It can, easily. It’s actually pretty trivial to write code to do this since Apple’s iPhone APIs are so thorough. A quick look at the Address Book Programming Guide for the iPhone will have you accessing the user’s contact list in no time in just a few lines of code. In a few more you can check for network connectivity and send the serialized contact information to any URL you want. Simple.

It would be difficult for Apple to catch this as they don’t reverse engineer your applications before approving them. You don’t submit your code, just your compiled file, so by just opening and looking at the application it’d be impossible to find a problem like this. You’d just have no idea.

I’m not advocating that people should do this, but it’s certainly something to think about. How would you know? One of the iPhone’s first hit games, Aurora Feint, did something less sinister with your contact data and was pulled from the App Store after people found out (ironically you could notice the issue if your iPhone was Jailbroken and you could peek into the directory data.) The only reason people found out was because Aurora Feint was re-storing your contacts’ data in another location which some iPhone programmers noticed. If they didn’t re-store it and simple sent the data, would anyone have noticed?

The newness and popularity of the iPhone platform leads me to believe that some people are currently working on nefarious ways to make money from unsuspecting users. When there’s money to be made, people will try to make it, no matter how immoral the means.

Posted January 14, 2009 with 2 Comments


Rudolf #

You can bet this will be misused, yes. No doubt about that.
The same can be said from the applications in facebook, by the way. Many of them are designed for the sole purpose of getting details of members.

Chris #

This is an issue we will see an increase of, in our society, as we increase our usage on personal data electronics. This is a very good point and something people should be aware of……dont trust your electronics just because they are used by a large group (or mass produced).

Post A Comment