Unofficial iOS app stores distribute custom apps with developer certificates

Clandestine app distributors like TutuApp, Panda Helper, AppValley and Tweakbox distribute custom iOS apps like Spotify, which allow users to listen without ads. The distributors misuse Apple-issued developer certificates for this.

Whether the certificates are stolen from other developers by the app stores or whether they get them themselves from Apple by registering as a developer is not clear. It doesn’t seem to be difficult anyway. Reuters writes that Apple had issued bans in response to this behavior by the app stores, but within days the same modified apps were distributed with a different developer certificate.

Another example is a free version of Minecraft for iOS. It normally costs 7.99 euros. There are also modified versions of Angry Birds and Pokémon Go, which contain cheats. It was also previously revealed that the certificates are being misused to distribute gambling and pornography apps. Two things that are not allowed on the App Store. The certificates make it possible to install apps from outside the App Store, but without a jailbreak.

The app stores even offer a paid subscription to the apps for $13 a year. For that, users get more stable versions of the custom apps. It is not known how much money is earned here and how many people use it. In response to these practices, Apple plans to require two-factor authentication on all developer accounts. That will take effect at the end of February.