Connect with us

Gaming

Apple fails to block porn & gambling ‘Enterprise’ apps – TechCrunch

Published

on

Facebook and Google were far from the only developers openly abusing Apple’s Enterprise Certificate program meant for companies offering employee-only apps. A TechCrunch investigation uncovered a dozen hardcore pornography apps and a dozen real-money gambling apps that escaped Apple’s oversight. The developers passed Apple’s weak Enterprise Certificate screening process or piggybacked on a legitimate approval, allowing them to sidestep the App Store and Cupertino’s traditional safeguards designed to keep iOS family-friendly. Without proper oversight, they were able to operate these vice apps that blatantly flaunt Apple’s content policies.

The situation shows further evidence that Apple has been neglecting its responsibility to police the Enterprise Certificate program, leading to its exploitation to circumvent App Store rules and forbidden categories. For a company whose CEO Tim Cook frequently criticizes its competitors for data misuse and policy fiascos like Facebook’s Cambridge Analytica, Apple’s failure to catch and block these porn and gambling demonstrates it has work to do itself.

Porn apps PPAV and iPorn (iP) continue to abuse Apple’s Enterprise Certificate program to sidestep the App Store’s ban on pornography. Nudity censored by TechCrunch

 

TechCrunch broke the news last week that Facebook and Google had broken the rules of Apple’s Enterprise Certificate program to distribute apps that installed VPNs or demanded root network access to collect all of a user’s traffic and phone activity for competitive intelligence. That led Apple to briefly revoke Facebook and Google’s Certificates, thereby disabling the companies’ legitimate employee-only apps, which caused office chaos.

Apple issued a fiery statement that “Facebook has been using their membership to distribute a data-collecting app to consumers, which is a clear breach of their agreement with Apple. Any developer using their enterprise certificates to distribute apps to consumers will have their certificates revoked, which is what we did in this case to protect our users and their data.” Meanwhile, dozens of prohibited apps were available for download from shady developers’ websites.

Apple offers a lookup tool for finding any business’ D-U-N-S number, allowing shady developers to forge their Enterprise Certificate application

The problem starts with Apple’s lax standards for accepting businesses to the enterprise program. The program is for companies to distribute apps only to their employees, and its policy explicitly states “You may not use, distribute or otherwise make Your Internal Use Applications available to Your Customers.” Yet Apple doesn’t adequately enforce these policies.

Developers simply have to fill out an online form and pay $299 to Apple, as detailed in this guide from Calvium. The form merely asks developers to pledge they’re building an Enterprise Certificate app for internal employee-only use, that they have the legal authority to register the business, provide a D-U-N-S business ID number and have an up to date Mac. You can easily Google a business’ address details and look up their D-U-N-S ID number with a tool Apple provides. After setting up an Apple ID and agreeing to its terms of service, businesses wait one to four weeks for a phone call from Apple asking them to reconfirm they’ll only distribute apps internally and are authorized to represent their business.

With just a few lies on the phone and web plus some Googleable public information, sketchy developers can get approved for an Apple Enterprise Certificate.

Real-money gambling apps openly advertise that they have iOS versions available that abuse the Enterprise Certificate program

Given the number of policy-violating apps that are being distributed to non-employees using registrations for businesses unrelated to their apps, it’s clear that Apple needs to tighten the oversight on the Enterprise Certificate program. TechCrunch found thousands of sites offering downloads of “sideloaded” Enterprise apps, and investigating just a sample uncovered numerous abuses. Using a standard un-jailbroken iPhone. TechCrunch was able to download and verify 12 pornography and 12 real-money gambling apps over the past week that were abusing Apple’s Enterprise Certificate system to offer apps prohibited from the App Store. These apps either offered streaming or pay-per-view hardcore pornography, or allowed users to deposit, win and withdraw real money — all of which would be prohibited if the apps were distributed through the App Store.

A whole screen of prohibited sideloaded porn and gambling apps TechCrunch was able to download through the Enterprise Certificate system

In an apparent effort to step up policy enforcement in the wake of TechCrunch’s investigation into Facebook and Google’s Enterprise Certificate violations, Apple appears to have disabled some of these apps in the past few days, but many remain operational. The porn apps that we discovered which are currently functional include Swag, PPAV, Banana Video, iPorn (iP), Pear, Poshow and AVBobo, while the currently functional gambling apps include RD Poker and RiverPoker.

The Enterprise Certificates for these apps were rarely registered to company names related to their true purpose. The only example was Lucky8 for gambling. Many of the apps used innocuous names like Interprener, Mohajer International Communications, Sungate and AsianLiveTech. Yet others seemed to have forged or stolen credentials to sign up under the names of completely unrelated but legitimate businesses. Dragon Gaming was registered to U.S. gravel supplier CSL-LOMA. As for porn apps, PPAV’s certificate is assigned to the Nanjing Jianye District Information Center, Douyin Didi was licensed under Moscow motorcycle company Akura OOO, Chinese app Pear is registered to Grupo Arcavi Sociedad Anonima in Costa Rica and AVBobo covers its tracks with the name of a Fresno-based company called Chaney Cabinet & Furniture Co.

You can see a full list of the policy-violating apps we found:

Apple refused to explain how these apps slipped into the Enterprise Certificate app program. It declined to say if it does any follow-up compliance audits on developers in the program or if it plans to change admission process. An Apple spokesperson did provide this statement, though, indicating it will work to shut down these apps and potentially ban the developers from building iOS products entirely:

“Developers that abuse our enterprise certificates are in violation of the Apple Developer Enterprise Program Agreement and will have their certificates terminated, and if appropriate, they will be removed from our Developer Program completely. We are continuously evaluating the cases of misuse and are prepared to take immediate action.”

TechCrunch asked Guardian Mobile Firewall’s security expert Will Strafach to look at the apps we found and their Certificates. Strafach’s initial analysis of the apps didn’t find any glaring evidence that the apps misappropriate data, but they all do violate Apple’s Certificate policies and provide content banned from the App Store. “At the moment, I have noticed that action is slower regarding apps available from an independent website and not these easy-to-scrape app directories” that occasionally crop up offering centralized access to a plethora of sideloaded apps.

Porn app AVBobo uses an Enterprise Certificate registered to Fresno’s Chaney Cabinet & Furniture Co

Strafach explained how “A significant number of the Enterprise Certificates used to sign publicly available apps are referred to informally as ‘rogue certificates’ as they are often not associated with the named company. There are no hard facts to confirm the manner in which these certificates originate, but the result of the initial step is that individuals will gain control of an Enterprise Certificate attributable to a corporation, usually China/HK-based. Code services are then sold quietly on Chinese language marketplaces, resulting in sometimes 5 to 10 (or more) distinct apps being signed with the same Enterprise Certificate.” We found Sungate and Mohajer Certificates were farmed out for use by multiple apps in this way.

“In my experience, Enterprise Certificate signed apps available on independent websites have not been harmful to users in a malicious sense, only in the sense that they have broken the rules,” Strafach notes. “Enterprise Certificate signed apps from these Chinese ‘helper’ tools, however, have been a mixed bag. Zoe example, in multiple cases, we have noticed such apps with additional tracking and adware code injected into the original now-repackaged app being offered.”

Porn apps like Swag openly advertise their availability on iOS

Interestingly, none of the off-limits apps we discovered asked users to install a VPN like Google Screenwise, let alone root network access like Facebook Research. TechCrunch reported this month that both apps had been paying users to snoop on their private data. But the iOS versions were banned by Apple after we exposed their policy violations, and Apple also caused chaos at Facebook and Google’s offices by temporarily shutting down their employee-only iOS apps too. The fact that these two U.S. tech giants were more aggressive about collecting user data than shady Chinese porn and gambling apps is telling. “This is a cat-and-mouse game,” Strafach concluded regarding Apple’s struggle to keep out these apps. But given the rampant abuse, it seems Apple could easily add stronger verification processes and more check-ups to the Enterprise Certificate program. Developers should have to do more to prove their apps’ connection with the Certificate holder, and Apple should regularly audit certificates to see what kind of apps they’re powering.

Back when Facebook missed Cambridge Analytica’s abuse of its app platform, Cook was asked what he’d do in Mark Zuckerberg’s shoes. “I wouldn’t be in this situation” Cook frankly replied. But if Apple can’t keep porn and casinos off iOS, perhaps Cook shouldn’t be lecturing anyone else.

Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Gaming

Former Ubisoft executives reportedly arrested over sexual assault allegations

Published

on

Getty Images / Ubisoft / Aurich Lawson

Five former Ubisoft executives have reportedly been detained for questioning by French authorities, years after they departed from the company amid widespread sexual assault allegations.

According to a report from France’s Libération newspaper (as translated by GamesIndustry.biz), this week’s arrests by the Bobigny public prosecutor’s office include Ubisoft’s former chief creative officer Serge Hascoët and ex-VP of editorial and creative services, Tommy François. Hascoët resigned from the company in July 2020, while Francois left less than a month later. A year after those departures, French labor union Solidaires Informatique worked with two of the alleged victims to file a formal complaint about the alleged assaults, which seems to have led to this week’s move by French police.

It’s not immediately clear who else has been caught up in this week’s police actions or whether the former executives will be released from detention after questioning. Other high-profile Ubisoft employees who resigned or were fired amid the 2020 allegations include Assassin’s Creed Valhalla director Ashraf Ismail, former Ubisoft Canada managing director Yannis Mallat; former Ubisoft PR director Stone Chin; former Ubisoft global head of HR Cécile Cornet, and former Ubisoft vice president of editorial Maxime Beland.

Allegations of toxic workplace behavior against multiple Ubisoft employees started on Twitter and were later expanded upon in wide-ranging reports from Liberation, Kotaku, and Bloomberg. The reports detail multiple instances of inappropriate verbal and physical conduct from numerous employees, including one worker who was reportedly choked at a 2014 party by Beland.

Before his departure, Hascoët had served at Ubisoft for 32 years, rising to become the effective right-hand man to CEO Yves Guillemot. Hascoët’s approval was reportedly necessary for almost every project at the company, and his input helped shape numerous games from the publisher.

Guillemot committed to “major changes” in a 2020 earnings call following the initial allegations, including an internal investigation, overhauled HR policies, and a full reorganization of the editorial department. “Our overriding aim is ensuring that all Ubisoft employees have a safe and inclusive workplace environment,” he said at the time.

A year later, though, a report by French newspaper Le Télégramme cited multiple employees in saying that changes inside the company had been minimal. The company answered that report with a blog post laying out “appropriate actions, including training, disciplinary sanctions, and dismissals.”

Continue Reading

Gaming

Wii U, 3DS online servers to shut down in six months

Published

on

Enlarge / We’d like to imagine there’s an actual Switch like this that Nintendo will be flipping in April.

The end is nigh for online network support on the aging Wii U and Nintendo 3DS platforms. Nintendo announced overnight that “online play and other functionality that uses online communication” on those consoles will stop working in “early April 2024,” just over a year after Nintendo shut off downloadable game purchases on both platforms through the eShop.

In a brief FAQ, Nintendo clarified that players will still be able to redownload purchased software and download game update data “for the foreseeable future.” Players will also still be able to transfer Pokémon off of a 3DS using the Pokémon Bank system after the planned shutdown. And software that uses the 3DS’s unique Street Pass system will also still work since it uses local wireless communication between systems without the need for a central server.

While there are still some people using this now-classic Nintendo hardware online, spot tests suggest that the player numbers aren’t huge these days. A GameXplain test from the beginning of 2023 found a handful of online players for Mario Kart 8 and Call of Duty games on Wii U, for instance, but failed to find opponents for Super Smash Bros. for Wii U and Mario Tennis Ultra Smash. A similar 3DS test by a YouTuber in January found similarly mixed results, though 3DS launch titles like Super Street Fighter 4 and Steel Divers still apparently had surprisingly strong online communities.

Nintendo already shut down the level upload features for the original Super Mario Maker in 2021, well after the release of its Switch sequel. Mario Kart 8 and Splatoon on the Wii U were also taken offline in March for “extended maintenance” to fix a security exploit. Those games remained offline until early August.

The upcoming Nintendo server shutdown will come almost exactly a decade after Nintendo pulled a similar kill switch for the original Wii and Nintendo DS. After that shutdown, hackers got to work reverse-engineering their own private servers to restore online gameplay. For the 3DS and Wii U, Pretendo is an active open source project that has already replicated some of the soon-to-be-defunct server functionality Nintendo plans to abandon next year.

Earlier this year, Nintendo finally stopped accepting repair requests for the system in Japan, years after doing the same in North America. Meanwhile, reports suggest that Nintendo is ramping up its plans to release a Switch successor next year.

Continue Reading

Gaming

Is Counter-Strike 2’s new match-abandonment penalty too harsh?

Published

on

Enlarge / Mark my words, if any of you jerks abandon the unit, there’ll be hell to pay…

Valve

Anyone who has played a bit of Counter-Strike probably knows the frustration of having a teammate bail on a match early on, leaving your team at a 4-on-5 disadvantage. The recently launched Counter-Strike 2 is trying to limit this problem by imposing a harsh new penalty for players who leave a match before it’s over. But that system is already drawing angry reactions from players who feel they’ve been punished unfairly for unintentional match departures.

In CS: GO, abandoning a competitive match early resulted in a “cooldown” period before you could join a new match. Those periods started at 30 minutes for the first offense and rose to a full week for a fourth offense (one offense was also expunged from the count every seven days).

That punishment system carried forward to the closed CS2 beta in recent months but was reportedly ineffective at slowing down extremely high match abandonment rates. A series of popular posts on the CS:GO subreddit last month asked for stronger punishments, complaining that “almost every single match now has one leaver… I get it, you haven’t played CS in years and you’re butthurt that you’re losing but you’re just wasting everyone else’s time if you leave.”

With the full public launch of C2 last week, Valve seems to have taken that complaint to heart. Leaving a match early now also gets a player a 1,000-point drop in the ELO rating used for competitive matchmaking. That’s a pretty significant penalty, considering players only gain about 100 points for winning a match (against similarly ranked opponents). Under the current system, it could take hours of play to rebuild the ranking loss resulting from a single abandoned match.

Unintended consequences?

That kind of penalty might be an appropriate deterrent for players who would intentionally hurt their teammates’ experience by abandoning tough matches early. But some players are complaining that the ELO penalty also applies to matches abandoned for unintentional reasons, including the kind of game crashes that can be relatively common in a newly launched online game.

Solo players can also receive the ELO penalty if their random teammates vote to kick them for any reason—or even no reason at all. “[This system] gives way too much power to groups of trolls,” one Reddit commenter said of the ability for four committed players to dock a stranger teammate’s rating. “I just lost 1,000 [ELO points] because a teammate randomly decided to [team kill] me and start a vote kick,” another Redditor added. “They were just unhappy to be losing with bad matchmaking. Worked my ass off to get up to 9k+ and got tossed down to 7999.”

Then there are situations where players decide to leave because of bad behavior by their teammates. “Last match I was in, there was a duo on my team that decided to troll and grief our entire team just because I’m a girl. I abandoned because they were just holding us hostage at that point,” one Reddit user wrote. This player complained that there was no warning that an extra ELO penalty would be tacked on for this match abandonment. “I gladly accepted the 30 minute cooldown but even in casual or deathmatch you get warned that you lose XP points if you abandon, in premier you don’t and I’m not sure why,” the player wrote.

There may be other unintended consequences to the new penalty system, as some players are already contemplating using ELO penalties to easily create a “smurf account” with an artificially low ranking to get matched up with less-skilled players. Meanwhile, some CS2 players also report that remaining players in a 4-on-5 game aren’t allowed to vote to surrender even when the player disadvantage makes the match seem hopeless.

We’re still early in what will no doubt be a long life for competitive Counter-Strike 2, so Valve could definitely continue to adjust these penalties as time goes on. For now, though, the new system highlights the tough balancing act the company faces in trying to enforce good sportsmanship for randomly grouped teams in their online shooter.

Continue Reading

Trending