Known security expert and Apple hacker Charlie Miller has href="http://www.forbes.com/sites/andygreenberg/2011/11/07/iphone-security-bug-lets-innocent-looking-apps-go-bad/">uncovered an exploit within iOS that exploits a flaw with Apple’s code signing on iOS devices. Miller has found a way to allow for an shady app to make it through the App Store approval process, but then be used for unscrupulous activities. Miller went as far as to plant an app in the App Store that demonstrates how it can be used to download new unapproved commands, allowing them to execute at will. The walled garden of iOS has been one that offered users a sense of comfort, being protected from malware of this sort. The commands could go as far as stealing photos, reading contracts or worse. Miller spoke with Forbes about his intention to display this at the SysCan conference in Taiwan next week. Shortly thereafter, he received a letter from Apple terminating his iOS developer license. The full context of the letter is below.
href="http://cdn.everythingicafe.com/wp-content/uploads/2011/11/CharlieMiller1-374x500.jpg" class="lightbox" >
class="alignnone size-full wp-image-25065" title="CharlieMiller1-374x500" src="http://cdn.everythingicafe.com/wp-content/uploads/2011/11/CharlieMiller1-374x500.jpg" alt="" width="374" height="500" />
From: appledevnotice@apple.com
/> Subject: Notice of Termination
/> Date: November 7, 2011 4:49:34 PM CST
/> To: [redacted]
Dear Charles Miller:
This letter serves as notice of termination of the iOS Developer Program License Agreement (the “iDP Agreement”) and the Registered Apple Developer Agreement (the “Registered Developer Agreement”) between you and Apple, effective immediately.
Pursuant to Section 3.2(f) of the iDP Agreement, you agreed that you would not “commit any act intended to interfere with the Apple Software or related services, the intent of this Agreement, or Apple’s business practices including, but not limited to, taking actions that may hinder the performance or intended use of the App Store or the Program”. Further, pursuant to Section 6.1 of the iDP Agreement, you further agree that “you will not attempt to hide, misrepresent or obscure any features, content, services or functionality in Your submitted Applications from Apple’s review or otherwise hinder Apple from being able to fully review such Applications.” Apple has good reason to believe that you violated this Section by intentionally submitting an App that behaves in a manner different from its intended use.
Apple may terminate your status as a Registered Apple Developer at any time in its sole discretion and may terminate you upon notice under the iDP Agreement for dishonest and misleading acts relating to that agreement. We would like to remind you of your obligations with regard to all software and other confidential information that you obtained from Apple as a Registered Apple Developer and under the iDP Agreement. You must promptly cease all use of and destroy such materials and comply with all the other termination obligations set forth in Section 12.3 of the iDP Agreement and Section 8 of the Registered Developer Agreement.
This letter is not intended to be a complete statement of the facts regarding this matter, and nothing in this letter should be construed as a waiver of any rights or remedies Apple may have, all of which are hereby reserved. Finally, please note that we will deny your reapplication to the iOS Developer Program for at least a year considering the nature of your acts.
Sincerely, Apple Inc.
Seems pretty cut and dry. As a developer, he could have reached out to Apple regarding the flaw. Instead he submitted a fake app, told his story to Forbes and planned to demo it at a conference. As for the bug, you can expect Apple to work on pushing an update rather quickly. Maybe this will speed up the release of the href="http://www.everythingicafe.com/apple-releases-ios-5-0-1-beta-to-developers/2011/11/02/">iOS 5.0.1 update that brings the much needed battery fix?
Source: href="http://www.forbes.com/sites/andygreenberg/2011/11/07/iphone-security-bug-lets-innocent-looking-apps-go-bad/">Forbes, href="http://news.cnet.com/8301-27076_3-57320190-248/apple-boots-security-guru-who-exposed-iphone-exploit/?tag=TOCmoreStories.0">CNET