Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Handy Light: Tethering App Camouflaged as Flashlight

appshopper.com

Post reply on HN
Print view View original

21–30 of 69 posts

Re: Handy Light: Tethering App Camouflaged as Flashlight

#21

Post by jmatt »

jmatt wrote: post #6
donohoe wrote: post #3

If true, I guarantee that Apple will use their “kill switch” to remove this app from any iPhones that have it installed.

I bought NetShare when it was briefly on the app store and it still works. Or at least it did last time I was at my cabin a few months ago with my 3G. If they were going to kill an app, I'd assume they would have killed that. And they didn't. Or if they claimed to have killed it then they failed. I bought this app. I'm more than willing to support the the Rebellion. I haven't actually verified that this app works as…

This may sound silly now, but a long time ago I bought myLite - an iphone flashlight app. And when the app starts it has a frustratingly long and dark splashscreen before you get the actual light.

Even as a flash light HandyLight outperforms myLite. When I start it - it's immediate white.

Re: Handy Light: Tethering App Camouflaged as Flashlight

#22

Post by maxjg »

wallflower wrote: post #12
jrockway wrote: post #2

I wonder how many other apps on Apple's "guaranteed-safe" App Store have hidden behavior like this? Since I can't actually audit the app code that runs on my device (like by compiling it myself), nor can I audit the OS, I guess I now have to assume that any application on my iPhone is compromised. (+) Apple should include a warning on the box to that effect. (+) I don't actually own an iPhone.

Apps are sandboxed. They can send and receive data over http/https at will. Location sharing is much more audited in iOS 4. Your calendar data and some address book data is not well protected. Your pictures are only accessible through the camera roll UI; apps can't slurp them.

Your contacts are pretty much completely unprotected as well. As an iPhone developer myself, I don't think it's unreasonable to have the device ask for permission to use this data (in a similar manner as location data access is approved).

Re: Handy Light: Tethering App Camouflaged as Flashlight

#23

Post by wallflower »

gmurphy wrote: post #17
DenisM wrote: post #16

I wish he'd release the source, then those of us with dev accounts would be able to use it.

Here's the source to one that doesn't require flashlight shenanegans: http://wiki.github.com/tcurdt/iProxy/

And, no, it's not possible to modify it to run in the background like Pandora because background networking/radio kills battery life.

Re: Handy Light: Tethering App Camouflaged as Flashlight

#24

Post by alextgordon »

wallflower wrote: post #4

I wonder why this guy thought sacrificing his iPhone developer status was a good idea. If it gets 'remote killed', it was all for naught. Maybe he's going Droid. EDIT: He's just a kid > Hi, I'm Nick Lee, an aspiring 15-year-old web designer and programmer. I consider ...

His app just hit the front pages of multiple high-traffic websites. It could well have been an excellent idea.

Re: Handy Light: Tethering App Camouflaged as Flashlight

#25

Post by gojomo »

gmurphy wrote: post #17
DenisM wrote: post #16

I wish he'd release the source, then those of us with dev accounts would be able to use it.

Here's the source to one that doesn't require flashlight shenanegans: http://wiki.github.com/tcurdt/iProxy/

Indeed -- any iOS developer ($100/year) can install this on their own phone, and give it to friends (by using one of the limited number of test-device registrations), without jailbreaking.

Re: Handy Light: Tethering App Camouflaged as Flashlight

#26

Post by gojomo »

wallflower wrote: post #23
gmurphy wrote: post #17

Earlier quoted context omitted.

Here's the source to one that doesn't require flashlight shenanegans: http://wiki.github.com/tcurdt/iProxy/

And, no, it's not possible to modify it to run in the background like Pandora because background networking/radio kills battery life.

Not directly, but -- if Pandora can make a fresh HTTP request out for each song-reload, could a not-quite-SOCKS proxy app make two outbound requests and relay traffic between them? Then, with some additional support on your laptop -- maybe just netcat in a loop -- things might work well enough for browsing.

Or could some novel proxy otherwise keep alive a tunnel to another machine in the background? The latest iSSH app says it can keep a session alive for 10 minutes in the background -- though it's not clear if it can relay significant data while backgrounded.

Re: Handy Light: Tethering App Camouflaged as Flashlight

#27

Post by wallflower »

fraXis wrote: post #20

I was able to get this app before it was removed. I followed the directions and it works perfectly on my Macbook Pro. However, it only works with Safari. It does not work with Chrome, Firefox, or any mail protocols (POP / IMAP / SMTP).

Without a server to tunnel ssh, it's not possible but with somr Apache/root server access, your best bet is tsocks which is not intuitive to get working.

http://gigo.com/archives/tsocks-on-the-mac.html

http://www.verot.net/socks.htm

Re: Handy Light: Tethering App Camouflaged as Flashlight

#28

Post by IgorPartola »

chc wrote: post #5
jrockway wrote: post #2

I wonder how many other apps on Apple's "guaranteed-safe" App Store have hidden behavior like this? Since I can't actually audit the app code that runs on my device (like by compiling it myself), nor can I audit the OS, I guess I now have to assume that any application on my iPhone is compromised. (+) Apple should include a warning on the box to that effect. (+) I don't actually own an iPhone.

I feel pretty vindicated, because I've been saying all along that the App Store review process is pointless at best, because the things apps are usually rejected for are fairly petty and it has almost no way of picking up on anything but the dumbest malware.

I think that should be "the things that people make a huge fuss about are pretty petty." I think that the review process adds a certain value to the App Store. I know that if I download an app, (1) it will run and (2) it will do more or less what the description says. That is not to say that this is the one true way, but it adds value.

I think a model that the web has followed is better: apps should be ranked based on some organic factors (e.g.: content of description + reviews) and the best apps can just float to the top. Security can be ensured via reviews/ratings + sandboxes access to phone's core functions.

Re: Handy Light: Tethering App Camouflaged as Flashlight

#29

Post by wallflower »

gojomo wrote: post #26
wallflower wrote: post #23

Earlier quoted context omitted.

And, no, it's not possible to modify it to run in the background like Pandora because background networking/radio kills battery life.

Not directly, but -- if Pandora can make a fresh HTTP request out for each song-reload, could a not-quite-SOCKS proxy app make two outbound requests and relay traffic between them? Then, with some additional support on your laptop -- maybe just netcat in a loop -- things might work well enough for browsing. Or could some novel proxy otherwise keep alive a tunnel to another machine in the background? The latest iSSH a…

Looks like iSSH is using beginBackgroundTaskWithExpirationHandler. So, yes, it's possible it would run for up to 10 min. in the background but my guess is the watchdog would kill the SOCKS app for taking up too much CPU time for a bg process and/or network access would be killed intermittently.

http://developer.apple.com/iphone/library/documentation/uiki...

"This method lets your application continue to run for a period of time after it transitions to the background."

Re: Handy Light: Tethering App Camouflaged as Flashlight

#30

Post by ajg1977 »

wallflower wrote: post #12
jrockway wrote: post #2

I wonder how many other apps on Apple's "guaranteed-safe" App Store have hidden behavior like this? Since I can't actually audit the app code that runs on my device (like by compiling it myself), nor can I audit the OS, I guess I now have to assume that any application on my iPhone is compromised. (+) Apple should include a warning on the box to that effect. (+) I don't actually own an iPhone.

Apps are sandboxed. They can send and receive data over http/https at will. Location sharing is much more audited in iOS 4. Your calendar data and some address book data is not well protected. Your pictures are only accessible through the camera roll UI; apps can't slurp them.

Contacts (and in iOS 4, calendar data) are completely unprotected. Just create an instance of an AddressBook and go to town. Your pictures are only accessible through the camera roll UI... IF the developer is only using public APIs.

Since we can assume that there are no public APIs that support tethering setup, we can also assume that it's still possible for them to be used in rogue apps and for developers to have access to private data.

Post reply on HN