1

I live in Iran, and here most Iranian apps are banned from the App Store, and are distributed using enterprise certificates. There are even Iranian app stores that use a single such certificate to install other apps, and they even sell some pirated apps through these. See, for example, https://sibapp.com/ and nassaab.com/ . Though these will probably not work with non-Iranian IPs.

In regard of the recent Facebook privacy scandal, I have become concerned how these apps affect my privacy, and what actions I can take to protect myself, and what actions Apple should be pushed to take. This phenomenon (of rogue Iranian apps) has high penetration rates in Iranian users. (Because everyone needs at least some of the services these apps deliver, including banking, SIM card's data and phone management, online taxis, ...)

I think banning apps but leaving illegal enterprise certificates is possibly the worst way to handle this problem.

Update: Nothing is shown on the device about the certificate: screenshot

Improve this question
1
  • 1
    I'll address some high level concerns and let someone else describe how to get the IPA file and analyze what entitlements were coded in to a specific app bundle. YOu'll need Xcode or some other command line tool to get to that level. My high level answer is going to be delete those apps. I am aware that the US government has a toddler level sophistication when it comes to treating normal business relations with your country. It would be far better if your apps didn't have financial difficulties so you could get Apple review on legit apps. Let's talk in Ask Different Chat if you have knowledge of that.
    – bmike ♦
    Feb 9, 2019 at 13:39

1 Answer 1

Reset to default
1

The short answer is a certificate has no entitlements, it simply turns off the App Store as the exclusive way to load apps. It doesn't change the code, install a VPN, add a passcode or anything, but what it does is disable one of the best privacy protections you have - Apple review of apps in the App Store.

The only worse thing than loading an enterprise app for security would be allowing MDM control so that someone could push changes / track your location / remote wipe your device and lock you out of the device or push apps to it.

You are correct to be worried about all those apps.

That certificate and entitlement are letting you know you are entering the Wild West, so to speak. (or in your case, would it be the Wild East or Wild Middle East?)

The warning indicates that nothing in that app was looked at by Apple. Apple didn't do a code review, didn't check that an app that says it's for putting a caption on a photo isn't instead uploading every photo including the date/time/GPS location to their servers to track / market / sell / collect information on every place you have a picture. They could even run facial recognition on the photos once they upload them.

Apple typically doesn't make developers not take the data they take, but they do make the developer let you know what the app does so at least we can all agree which apps will track what taps you make on screen and which don't. (for instance)

The recent press on this shows that VPN apps didn't disclose to the end users so if your apps enable VPN (look in the iOS settings for VPN) then you pretty much can't trust that anything wasn't sent to a server and then decrypted - stored and then re-encrypted to send to the final destination.

Basically, this allows a "man in the middle" attack so you can't trust that some difficulty is needed to decrypt your traffic. Already, we know we can't trust any telecom company not to record / tap / data mine every bit of data we send, but most of us expect that SSL encryption means that it will cost someone time and money to crack our traffic.

Now, it might be that the entire country of Iran is on some government's watch list and your traffic is already being decrypted, but this certificate allows that telecom to also see and monitor you in ways Apple tries to prevent by apps they put in their App Store.

For me, I don't ever install these on my personal devices. If I need a work device to have work apps, I let work provide me that device and I do work things on my work device and assume they get everything on that device. It's too hard for me to do app review so I simplify my privacy by not letting a third party install root certificates / SSL / unreviewed apps.

Improve this answer
5
  • A very good and informative answer. Just to e bit nitpicky, Apple doesn't do what's usually considered a "code review". They don't look at an apps source code, i.e. as a dev you don't have to provide that. Of course they look and analyze the binary you send to the AppStore (well, that could technically be called a code review, just not source code review). Other than that your advice is a good one. I feel sorry for the Iranian users, they have to chose between no security or no usage at all. :(
    – Gero
    Feb 9, 2019 at 22:05
  • @Gero In fact, when the majority of the users are compromised, it doesn't matter much if you choose no usage. Other people are still leaking much of your data.
    – HappyFace
    Feb 10, 2019 at 12:12
  • If the certificate has no entitlements, how could Facebook even read private messages of the users? That shouldn't be possible even if you are using the VPN service of a compromised app.
    – HappyFace
    Feb 10, 2019 at 12:14
  • If the app in question is build with the regular SDKs from apple you're right, most of the important stuff is caught by those and the OS (accessing location services, e.g., makes a popup appear confirming the user allows this). However, apps not downloaded from the regular AppStore could be linked against libraries that were tampered with and since there is no review (checking the certificates of the used libs) that could open a vector to all kinds of malicious stuff.
    – Gero
    Feb 10, 2019 at 12:24
  • @HappyFace The VPN app had a certificate that Apple didn’t approve and used that app to sign the traffic and the VPN directed the traffic to servers that could / did decrypt and log / track the data. Apple won’t allow shady certificates so the VPN broke that protection from what I read. I did not analyze the facebook VPN but businesses do that all the time. It’s called deep packet inspection and MITM attack. Also, once you own the network, you don’t often need to know what’s in the message as the headers and open parts tell you all you need to know.
    – bmike ♦
    Feb 10, 2019 at 15:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .