Apple Boots Security Researcher for Rogue App

In a move to prove that Apple's App Store could be stocked with apps containing malicious code, a notable security researcher put a rogue app into the store. Now, that notable security researcher is banned from Apple's developer program.

Charlie Miller, a principal research consultant for Accuvant, a security firm in Denver, tapped into a previously undiscovered flaw in Apple's iOS to develop an app that essentially "phoned home" to his own server. This is the same Miller, by the way, who has won the annual Pwn2Own hacking contest four times -- the only one to win it four times.

Here's the background: Miller developed a fake stock ticker app. He called it Instastock. That app served as his proof of concept. Miller put the app through Apple's submission process and got the green light. Instastock showed up on the App Store's virtual shelves in September. Apple didn't take kindly to the experiment. Apple won't let Miller back in its developer program for a year.

Miller Lashes Out

The flaw Miller discovered would let an app creator execute arbitrary code on Apple mobile devices that run iOS 4.3 or later. The flaw deals with the way iOS handles code signing. Code signing is important because it is a mechanism to protect users from malware. Essentially, Miller said, the flaw allows the apps to run new code even if Apple hasn't checked it.

"You can imagine downloading a nice app like Angry Birds but instead of just being Angry Birds it actually can download and do anything it wants, and Apple would have no idea that it happened," Miller said in a YouTube video that explains how attackers could use the flaw.

Since Apple banned him from its developer program, Miller has been vocal on Twitter. Among his tweets on Monday: "Apple has removed my app from the app store, those bastards!" and "OMG, Apple just kicked me out of the iOS Developer program. That's so rude!" and later Monday afternoon, "First they give researchers access to developer programs (although I paid for mine), then they kick them out...for doing research. Me angry."

Apple's Example

Michael Disabato, managing vice president of network and telecom at Gartner, doesn't see how Miller has any right to complain about Apple's moves to remove the Instastock app from the App store -- or remove him from the developer program.

"He signs an agreement to get into the developer program that says he's not going to do anything like this. He proceeds to do something that violates his developer program terms and conditions," Disabato said.

"He actually puts in a fake stock ticker program that could cause people financial harm if he's not accurate in the stock prices he's given them. Apple finds out and kicks him out because he's essentially put in a rogue application and now he complains. Welcome to the United States of America. Apple had to kick him out."