Apple begins strictly enforcing rule that prohibits iOS app updates outside of App Store

Posted:
in iPhone
Apple is starting to more uniformly enforce a restriction in place since the beginning of the App Store, and is notifying developers pro-actively that it will refuse approval to new apps or updates that include mechanisms to update or alter pre-approved app behavior outside the app store.




Developers, sometimes with apps already approved and for sale, are receiving a notification from Apple informing them of the issue, and advising them to remove offending code prior to the next update. Apple cites two relevant rules in the message, specifically, section 3.3.2 of the Apple Developer Program License Agreement and App Store Review Guideline 2.5.2.

Both rules have been in place since the dawn of the iOS app store. However, popular iOS troubleshooting and update tool, Rollout.io, is impacted by the enforcement and claiming that Apple is interpreting the guidelines in a "more narrow way," which will cause problems with the service.

Rollout allows developers to "push code-level changes" to native iOS apps. This allows for coders to "fix bugs, update configuration data, patch security holes or diagnose issues" without dealing with the sometimes lengthy app store review process.

"We are disappointed that Apple has made this change before we have had an opportunity to address any concerns," Rollout says in a blog post. "We have already reached out to Apple to discuss and are committed to adjusting our offering as needed to remain in compliance under the more narrow interpretation of the guidelines."

App Store review guideline 2.5.2 mandates that "Apps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they download, install, or execute code, including other iOS, watchOS, macOS, or tvOS apps."

Apple Developer Program License Agreement section 3.3.2 is similar, and says that an application "may not download or install executable code" and "interpreted code may only be used in an Application if all scripts, code and interpreters are packaged in the Application and not downloaded."

Apple claims that the forbidden frameworks can "easily be hijacked via a Man In The Middle (MiTM) attack" and "can pose a serious security vulnerability to users."

AppleInsider has reached out to Apple for further elaboration of why more strict enforcement of the near-decade-old rule is being applied now, and will update accordingly. While it may be coincidental, the first reports of the stricter enforcement of the app store rules surfaced on March 7, the same day as the WikiLeaks publication of the CIA's iOS, Android, and Windows hacking division.
«1

Comments

  • Reply 1 of 23
    melgrossmelgross Posts: 32,954member
    I imagine that it is due to the leaks. I'm surprised that Apple hasn't enforced it before.
    SpamSandwichlolliverdamn_its_hotjohn.bcornchip
  • Reply 2 of 23
    While it will be a pain for some legitimate apps, I have to agree with Apple here. 
    SpamSandwichdamn_its_hotwatto_cobraGeorgeBMacjony0john.bcornchip
  • Reply 3 of 23
    The only app I've experienced this with is my First Direct (HSBC) banking app, it downloads and updates within the app.
  • Reply 4 of 23
    OshturOshtur Posts: 1unconfirmed, member
    Any other examples of apps (the more popular the better) that actually do this?
  • Reply 5 of 23
    maestro64maestro64 Posts: 4,908member
    melgross said:
    I imagine that it is due to the leaks. I'm surprised that Apple hasn't enforced it before.

    Exactly what I thought, this is all about the CIA leaks and what they could do, Imagine the Mobile Passport which is put out for the government had the ability to update code outside the apple system of checks and balance the our government installs code which allows them to watch what you are doing. This could be down with any app, the NSA could set up a fake company making some sort of great app that everyone would down load and want to use.
    cornchip
  • Reply 6 of 23
    maestro64maestro64 Posts: 4,908member
    adm1 said:
    The only app I've experienced this with is my First Direct (HSBC) banking app, it downloads and updates within the app.

    I personally have not see any, I have a few which come up and say I am out of date but push me to the apple store for the update. It is interesting a banking App would do this.
  • Reply 7 of 23
    maestro64 said:
    adm1 said:
    The only app I've experienced this with is my First Direct (HSBC) banking app, it downloads and updates within the app.

    I personally have not see any, I have a few which come up and say I am out of date but push me to the apple store for the update. It is interesting a banking App would do this.
    ... but not surprising when that bank is HSBC.
    smaceslinSpamSandwichlollivercornchip
  • Reply 8 of 23
    Would this affect those large games that download a small amount, install, then on first run download the rest of the game from within the app? I'm sure from memory Real Racing was one of those that did that.
  • Reply 9 of 23
    jkichlinejkichline Posts: 1,348member
    adm1 said:
    Would this affect those large games that download a small amount, install, then on first run download the rest of the game from within the app? I'm sure from memory Real Racing was one of those that did that.
    No. That is downloading game data (maps, textures, shaders, etc) so it's not modifying code or executables.
    watto_cobra
  • Reply 10 of 23
    asdasdasdasd Posts: 5,626member
    adm1 said:
    The only app I've experienced this with is my First Direct (HSBC) banking app, it downloads and updates within the app.
    In terms of normal general apps that too is the only one I noticed. 
    adm1 said:
    Would this affect those large games that download a small amount, install, then on first run download the rest of the game from within the app? I'm sure from memory Real Racing was one of those that did that.
    No. That is downloading game data (maps, textures, shaders, etc) so it's not modifying code or executables.
    Well it might be but I see games add new features every so often, add new events and so on. Not sure how this will work for them. 
  • Reply 11 of 23
    seanismorrisseanismorris Posts: 1,624member
    Security # 1
    watto_cobraGeorgeBMaccornchip
  • Reply 12 of 23
    xbitxbit Posts: 277member
    Oshtur said:
    Any other examples of apps (the more popular the better) that actually do this?

    Tinder, Glassdoor, Target, Kobo... probably many others.

    It's used extensively for A/B testing. It's designed to be completely transparent to the end user.

    I'm really surprised that Apple has allowed these frameworks to slip under the radar for so long.
    cornchip
  • Reply 13 of 23
    rs0212rs0212 Posts: 20member
    adm1 said:
    The only app I've experienced this with is my First Direct (HSBC) banking app, it downloads and updates within the app.
    I was just going to post the same thing!  HSBC is the only app I've ever used that does this, and sometimes it doesn't give the option to install later, so I have to wait for around a 1 megabyte update to download when I just want to check my balance!!
    asdasdwatto_cobra
  • Reply 14 of 23
    asdasd said:
    adm1 said:
    The only app I've experienced this with is my First Direct (HSBC) banking app, it downloads and updates within the app.
    In terms of normal general apps that too is the only one I noticed. 
    adm1 said:
    Would this affect those large games that download a small amount, install, then on first run download the rest of the game from within the app? I'm sure from memory Real Racing was one of those that did that.
    No. That is downloading game data (maps, textures, shaders, etc) so it's not modifying code or executables.
    Well it might be but I see games add new features every so often, add new events and so on. Not sure how this will work for them. 

    Usually those new features and such are already in the executable from a previous app update, and they just enable or disable the functionality based on a response from a server somewhere. This is still allowed under the guidelines and wouldn't change. Facebook does this a ton, and so does Google.

    My guess is they used to let this slide because of the very long review times, which is really the reason these tactics became popular in the first place. Now that app reviews are only a day or two on average there is less reason to need services like this, and my guess is Apple will point to shortened review times as a major reason they're cracking down on it: "it's just not necessary anymore."
    asdasd
  • Reply 15 of 23
    frantisekfrantisek Posts: 730member
    I am surprised that it is possible at all.
    damn_its_hot
  • Reply 16 of 23
    An obvious security improvement.
    damn_its_hotwatto_cobra
  • Reply 17 of 23
    mike1mike1 Posts: 2,595member
    asdasd said:
    adm1 said:
    The only app I've experienced this with is my First Direct (HSBC) banking app, it downloads and updates within the app.
    In terms of normal general apps that too is the only one I noticed. 
    adm1 said:
    Would this affect those large games that download a small amount, install, then on first run download the rest of the game from within the app? I'm sure from memory Real Racing was one of those that did that.
    No. That is downloading game data (maps, textures, shaders, etc) so it's not modifying code or executables.
    Well it might be but I see games add new features every so often, add new events and so on. Not sure how this will work for them. 
    They add new levels and features with legitimate app updates through the app store.
  • Reply 18 of 23
    asdasdasdasd Posts: 5,626member
    mike1 said:
    asdasd said:
    adm1 said:
    The only app I've experienced this with is my First Direct (HSBC) banking app, it downloads and updates within the app.
    In terms of normal general apps that too is the only one I noticed. 
    adm1 said:
    Would this affect those large games that download a small amount, install, then on first run download the rest of the game from within the app? I'm sure from memory Real Racing was one of those that did that.
    No. That is downloading game data (maps, textures, shaders, etc) so it's not modifying code or executables.
    Well it might be but I see games add new features every so often, add new events and so on. Not sure how this will work for them. 
    They add new levels and features with legitimate app updates through the app store.
    I have a games app that adds new levels every weekend. Something downloads . It could be assets with the code already there - hard to tell. 

    Anyway I think Apple should introduce A/B testing. 
  • Reply 19 of 23
    Rayz2016Rayz2016 Posts: 6,697member
    adm1 said:
    The only app I've experienced this with is my First Direct (HSBC) banking app, it downloads and updates within the app.
    I've come across a couple of other banking apps that do this too. Like the First Direct app, they're all just web pages running inside a container. 
  • Reply 20 of 23
    melgrossmelgross Posts: 32,954member
    It's easy to tell if an app has done this if it tells you about an update. If you go to the App Store Updates, and see an update there, then it's from Apple, and all is ok. If you don't see an update there, then it's not coming from Apple.

    i know its obvious. But I've had several apps, including a couple from Adobe tell me to update the apps. That seems strange, doesn't it? After all, you shouldn't need to update the apps. But often I go to updates (I have hundreds of apps on my ipad!), and there's a dozen apps waiting to be updated, including the Adobe one. It seems that when I open the app, it knows there's a new update, but for some reason, the iPad hasn't yet updated.
Sign In or Register to comment.