Pirated iOS App Store’s Client Successfully Evaded Apple iOS Code Review
Summary: Unit 42 identified an app called "Happy Daily English" that served as a third-party App Store client for pirated iOS apps and evaded Apple's review by showing an English-study interface to users outside mainland China while revealing its real features inside China. The app, submitted October 30, 2015 and removed February 19, 2016 after Unit 42 reported it, re-implemented iTunes client protocols and Xcode functionality to obtain free personal development certificates from Apple's servers, and Unit 42 also found over 50 samples signed by nine different enterprise certificates spread across 32 channel IDs.
Why it matters: The app's Lua framework allowed its code to be remotely updated without further Apple review, and it asked users in China to install configuration profiles - including a device enrollment challenge - signed by a GoDaddy-issued certificate for xyzs.com, meaning a reviewed App Store listing could still push unreviewed code and enroll devices into MDM.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026