Mac App Store (Photo credit: Wikipedia)
When you download an app from Apple's App Store, you assume that it's been checked over by a team of reviewers at Cupertino and given the all-clear. It makes you feel safe, right?
Sorry to burst your bubble, but it seems that the review process is not infallible.
Russian security firm Kaspersky Lab discovered an app called "Find & Call," available in both the Google Play (although only from the Russian version of the store) as well as the Apple App Store, that was secretly harvesting data from users’ address book and sending information to the developer's server. This data was, in turn, used to spam users with SMS messages.
The "Find & Call" app advertised itself as a "tool for aggregating and simplifying contacts" and made no mention of helping itself to users' address books.
"Our analysis of the iOS and Android versions of the same application," writes Kaspersky Lab Expert Denis Maslennikov, "showed that it’s not an SMS worm but a Trojan that uploads a user’s phonebook to remote server".
This is the first example of malware to hit Apple's otherwise clear and safe App Store, and it has been available for download since mid June.
Both Apple and Google have now removed the app from their respective app stores.
However, in a statement to AppleInsider.ru, the author of the app claims that the spamming feature is a bug, and that the "bug is in process of fixing".
Several readers have asked me whether the App Store now is now an unsafe place. Personally, given the tens of thousands of apps that have been successfully reviewed, it was inevitable that malware would eventually make its way inside the fortress.
Just like the bug with the DRM servers that caused the App Store to push out corrupted apps, these are mistakes that Apple -- just like every other company -- will learn from. With every blunder, both Apple and Google are learning how to make their download portals safer for all.
After all, while in an ideal world mistakes wouldn't be made in the first place, if you do make a blunder, then the next best thing is to try to learn from it.
