Headlines >>›› •Beaver’s Revenge•Hardest Game Ever 2•Four Features We Want to See in Android (and How to Get Them)•Android Game Sales Will Exceed Traditional Handhelds by the End of the Quarter•A Stretched Samsung Chases Rival Apple’s Suppliers•Apple’s Cook to Propose Tax Changes at Congressional Hearing: Report•New iPhone 5S Alleged Components Hint at Internal Improvements•Apple Fights Back in Antitrust Case Over E-Book Prices•Apple CEO Tim Cook Goes on Offense in Washington D.C. Over $100 billion Offshore Cache•Analyst: Samsung, BlackBerry Marketing Tends to Mentally Enslave the Indian Consumer

Apple Adds HTTPS Encryption to App Store

March 11, 2013 - A Lux - No Comments

Update comes almost a year after researcher reported several security vulnerabilities

Apple (NASDAQ:AAPL) has added security encryption to its App Store, almost a year after a Google (NASDAQ:GOOG) researcher brought a vulnerability to the company’s attention that allowed users to make unauthorized purchases.

Researcher Elie Bursztein revealed on his blog that he had alerted Apple of numerous security issues last July but that Apple had only turned on HTTPS for the App Store last week. HTTPS is a more secure version of the HTTP standard and is commonly used in commerce and banking.

“While the Apple App Store is a native iOS app, most of its active content, including app pages and the update page, is dynamically rendered from server data. The server data is mostly standard Web data (HTML/Javascript/CSS) with custom extensions/keywords,” explained Bursztein. A user only needs to be accessing a shared network such as public Wi-Fi for a malicious party to steal their password, force the user to purchase a different app or upgrade or unknowingly grab sensitive information.

For example, a user attempting to purchase or update an app could become the victim of a man-in-the-middle attack. Without an HTTPS in place, the attacker could swap out the item the user was attempting to purchase and replace it with their own overpriced or malicious app.

Apple first implemented this change for the Chinese version of the App Store late last year. In its list of security updates Apple thanked Bursztein as well as Bernhard Brehm of Recurity Labs and Rahul Iyer of Bejoi.

Apple did not immediately respond to comment on the update.

Earlier this week Apple Senior President of Worldwide Marketing Phil Schiller took a swing at Google’s mobile security, after a study revealed that almost 80 percent of mobile malware threats in 2012 targeted Android devices. 

Source: http://www.fiercemobilecontent.com/story/apple-adds-https-encryption-app-store/2013-03-08?utm_source=rss&utm_medium=rss
VN:F [1.9.13_1145]
Rating: 0.0/10 (0 votes cast)
VN:F [1.9.13_1145]
Rating: 0 (from 0 votes)