Apple is sealing up a security hole popularly used to install emulators and other software barred from its App Store.
The latest beta versions of iOS 8.1, expected to be released to the public in late October, prevent users from using the bug, known as the “date trick”, to install unsigned apps straight from Safari onto their iOS devices – so-called “side loading”.
In unpatched versions of iOS 8, the trick involves setting the date of a device back by at least one day, downloading the app from Safari, and then resetting the date. Doing so fools the operating system into believing that the downloaded app is signed by Apple.
The trick has been put to use by developers of apps that are typically banned from the App Store, most notably emulator developers, who produce software that lets iOS users play games from older consoles on their phones and tablets.
That community has reacted poorly to the change. Dario Sepulveda, a beta tester for GBA4iOS, an emulator for Nintendo’s Game Boy Advance and Game Boy Color consoles, in a blog post titled “Apple Is Slowly Killing Everything We Love”, wrote that “this was a long-time coming; we knew this would one day arrive.
“I’m aware that Apple isn’t primarily at fault here (or that they are even specifically targeting the emulator community),” he continued. “Every year they grow more conscious of the smaller security holes and their mission is to perfect the system; I respect them for that.”
But while the trick is widely used by emulators, it seems unlikely that they were the sole target of Apple’s patch. The company has a long history of closing up holes that have been used by customers to do install unauthorised software on their devices, going right back to 2007 when it fixed a bug in the handling of .tiff image files, which had been used to “jailbreak” iPhones, allowing users to install any software on them.
The problem the company faces is that any method that can be deliberately used to install software from sources other than its App Store can also be abused to install malware. A key differentiator between Google’s approach with Android and Apple’s approach is that only the former is happy to make that trade-off – with the result that 98% of mobile malware targets Android devices.
When iOS 8.1 is released, users who want to retain access to sideloaded apps may face a difficult decision as to whether to upgrade. The new version of the operating system will be required to enable Apple Pay, the company’s mobile payment system, improvements to Apple’s Maps App, and the company’s “Convergence” suite of linkages between iOS and Mac OS X.
