You get no 'phone design' problems with iPhones. They work. Start to see the difference?
Yeah coz there's been never any design issues with iphones, like Antennagate on the iPhone 4.
Now I'm not sure if you're trolling or not?
Stop spreading FUD this attack is purely theoretical since anyone using it would have to get it through the app store. Even update packets are signed and verified. Also if a dev would try to pull something like this he would never develop for Apple again. Apple store is not like Google play where anyone with an e-mail and 20 bucks can publish stuff. You need to register and get approved.
FUD? Maybe you should WATCH the video, maybe you should read the official CERT warnings (
https://www.us-cert.gov/ncas/alerts/TA14-317A ). If you pulled your head out of apples backside long enough to see the real world you would have noticed this attack does not install from the app store nor does it require the replace malware to get past apple.
Here's the official CERT posting:
Alert (TA14-317A)
Apple iOS "Masque Attack" Technique
Original release date: November 13, 2014 | Last revised: November 17, 2014
Print Document
Tweet
Like Me
Share
Systems Affected
iOS devices running iOS 7.1.1, 7.1.2, 8.0, 8.1, and 8.1.1 beta.
Overview
A technique labeled “Masque Attack” allows an attacker to substitute malware for a legitimate iOS app under a limited set of circumstances.
Description
Masque Attack was described by FireEye mobile security researchers [1] (link is external), Stefan Esser of SektionEins, and Jonathan Zdziarski. This attack works by luring users to install an app from a source other than the iOS App Store or their organizations’ provisioning system. In order for the attack to succeed, a user must install an untrusted app, such as one delivered through a phishing link.
This technique takes advantage of a security weakness that allows an untrusted app—with the same “bundle identifier” as that of a legitimate app—to replace the legitimate app on an affected device, while keeping all of the user’s data. This vulnerability exists because iOS does not enforce matching certificates for apps with the same bundle identifier. Apple’s own iOS platform apps, such as Mobile Safari, are not vulnerable.
Impact
An app installed on an iOS device using this technique may:
Mimic the original app’s login interface to steal the victim’s login credentials.
Access sensitive data from local data caches.
Perform background monitoring of the user’s device.
Gain root privileges to the iOS device.
Be indistinguishable from a genuine app.
Solution
iOS users can protect themselves from Masque Attacks by following three steps:
Don’t install apps from sources other than Apple’s official App Store or your own organization.
Don’t click “Install” from a third-party pop-up when viewing a web page.
When opening an app, if iOS shows an “Untrusted App Developer” alert, click on “Don’t Trust” and uninstall the app immediately.
Further details on Masque Attack and mitigation guidance can be found on FireEye’s blog [1] (link is external). US-CERT does not endorse or support any particular product or vendor.
References
[1] FireEye (link is external)
Revisions
November 13, 2014: Initial Release
November 17, 2014: Vulnerability attribution amended
And.... before you jump in with "but the user has to tap on install", this is how 99% of Windows PC get infected, idiots clicking on links etc. And imho the apple user base is not significantly smarter (if at all) than the Windows user base.