Cybersecurity

Apple pulls apps over security concerns

Apple is playing defense against hackers
VIDEO0:2500:25
Apple is playing defense against hackers

Apple has removed some products from its App Store over concerns they could compromise users' sensitive details, the U.S. technology giant said on Friday.

The maker of the iPhone and iPad did not reveal how many apps had been taken down, but the problem appeared to center on products that install "root certificates".

Ad blockers in particular use root certificates as a means of blocking ads within apps. But root certificates allow the developers of those apps to view unencrypted traffic from their users such as the web pages you are visiting -- which could include sensitive financial information.

An Apple store in New York.
Mike Segar | Reuters

This type of process exposes this secure traffic as it is being transported from your phone to the app's servers. A hacker could potentially carry out what's known as a "man-in-the-middle" attack to intercept this traffic and steal sensitive data.

However, Apple has not indicated that anything malicious has happened so far.

In the latest update to its operating system, the Cupertino-based tech giant has built in the safe capability for ads to be blocked in its Safari mobile browser. But the apps that were pulled were blocking ads by installing root certificates, which is insecure.

"Apple is deeply committed to protecting customer privacy and security. We've removed a few apps from the App Store that install root certificates which enable the monitoring of customer network data that can in turn be used to compromise SSL/TLS security solutions," the company said in a statement.

"We are working closely with these developers to quickly get their apps back on the App Store, while ensuring customer privacy and security is not at risk."

Been Choice, an in-app ad blocker, was one such app affected by Apple's move. The company confirmed via Twitter that it was making changes and will resubmit its app to comply with Apple's policy.

TWEET