(Image: Cult of Mac / Forbes)
 

BY JIM FLINK

Don’t bite into Apple the wrong way. It just might bite you back. That’s the lesson Charlie Miller learned when he recently discovered, and publicly shared, how to get malware past Apple’s app development team. Gizmodo reports...

“Charlie Miller exposed a threat to the security of iOS devices by creating an app that could exploit a javascript exception in mobile Safari. The exception allowed the download of malicious code after an app has already been accepted into the App Store.”

Now, it’s one thing to do it yourself. It’s a whole ‘nuther thing to share it on YouTube. Here’s Charlie.

CHARLIE MILLER: “What I’ve found allows apps in the app store to download new code and run it, even if it’s not signed, and even if it hasn’t been checked by Apple.  So you can imagine downloading a nice app like Angry Birds, but instead of just being Angry Birds, it actually can download and do anything it wants”

Shortly after posting that video, and Forbes picking up the report, Charlie got a rude surprise. Tweeting...

“OMG, Apple just kicked me out of the iOS Developer program. That's so rude!”

Not sure what Charlie expected to get from Apple.  A bouquet and a thank you card? Cult of Mac says, while Charlie didn’t actually plant malware, he planted a seed of an idea by showing how to do so on such a public forum.

“Miller has been hacking Apple’s products for years, and this most recent bug is a particularly nefarious exploit that could be used for all kinds of evil purposes. Charlie Miller is one of the good guys, however. ... As a respected security researcher with a track record of exploiting Apple’s products, one could argue that Miller could have reported the exploit to Apple directly instead of planting a malicious app in the App Store.”

Cult of Mac also notes, because Apple is viewed as so malware-proof, this is a big chink in Apple’s seemingly otherwise spotless armour and image. But Daring Fireball notes, it warned of exactly this kind of breach in April. Noting, it kind of goes with the territory.

“It’s a trade-off. Most OSes allow marking memory pages as executable for performance reasons. iOS disallows it for security reasons. If you allow for pages of memory to be escalated from writable to executable (even if you require the page be made permanently read-only first), then you are enabling the execution of unsigned native code. It breaks the chain of trust.”

Fireball says, with iOS 4.3, Apple traded faster performance for the possibility of security breaches. So is Charlie a villain or a savior? The Verge asks a bigger question. Given its response, which role is Apple playing?

“...it still strikes us as draconian when the man’s trying to alert Apple to the problem instead of exploiting it for his own gain.”

Engadget notes, now that he’s opened Pandora’s Box, Charlie isn’t finished talking yet. He’s traveling to a huge tech conference in Taiwan to tell all.  While Apple scrambles to control the damage.

“He’ll be explaining his method in more detail next week at SysCan, but until the hole is confirmed closed we'd probably keep a tight leash on our app store browsing.”

Transcript by Newsy.