Question about recent "hack" of Apple Apps...

[theo]

I openly and willingly admit my general state of computer / techno ignorance. I'm wondering if some more technically savvy TUGGER might be able and willing to explain in comprehensible layman terms how malicious code in apps can somehow "get past" Apple when all apps supposedly get "screened" by Apple before becoming "approved" and then openly offered via the Apple Store?

This question is not a knock on Apple. My first smart phone after decades with a flip phone was (...and still is) a Apple 5s. I think the device is wonderful and truly impressive and I tip my cap to Apple. I like the device a lot and should have "converted" sooner.

I've read through the list of (known.....so far, anyhow) "hacked" apps and I don't have or want or use any of them, so my question is not "what happens to me now"?
My question is about internal procedure at Apple. Specifically, how do 80+ (...and counting?) apps containing malicious code (malicious code apparently discovered by others outside of Apple, by the way) manage to escape the notice of whatever Apple techies actually examine that stuff as their job responsibility before an app is subsequently offered through the Apple Store?

I'm just not grasping this at all.

 

[SmithOp]

Apple provides developers with software to create apps, called xcode kit. This kit was found to be hacked to add unwanted code to apps developed used the bad version. Once the bad version was found Apple removed all the apps created using this bad version.

This bad version of the developer kit was distributed inside China, it was a faster way for Chinese developers to download the kit due to the restrictive firewall that Chinese govt has in place. Downloads from Apple and other US sites are very slow because of the firewall.


Sent from my iPad using the strange new version of Tapatalk

 

[bnoble]

As for why it was not detected: the code is injected by the compiler, it's not part of the source that is reviewed. These kinds of attacks are very very hard to find. Indeed, Ken Thompson (the creator of UNIX) talked about a particularly clever version of this at his Turing Award ceremony:

http://delivery.acm.org/10.1145/360..._=1442938808_8bf3fd0150f55fcfe91d0fca6ac19115

 

[theo]

As for why it was not detected: the code is injected by the compiler, it's not part of the source that is reviewed. These kinds of attacks are very very hard to find. Indeed, Ken Thompson (the creator of UNIX) talked about a particularly clever version of this at his Turing Award ceremony:

http://delivery.acm.org/10.1145/360..._=1442938808_8bf3fd0150f55fcfe91d0fca6ac19115

Couldn't successfully access the above link, but will try other avenues to see if I can find / view Mr. Thompson's commentary (which I may not comprehend anyhow).

 

[bnoble]

Right, it's probably firewalled. Here's another version:

https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf

 

[theo]

Right, it's probably firewalled. Here's another version:

https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf

I shouldn't have looked and read --- now I feel even more "computer stupid".