I have to disagree with you. For hopefully obvious reasons. So long as they don’t abuse the killswitch, i’ll be happy that they have the ability to quickly kill an app that is known to be malicious.

i think you are hugely exaggerating this. It is disingenuous to bring in the Sony rootkit incident because Apple make the iPhone and the AppStore – its their product and they are responsible for ensuring it remains secure, both at the point of purchase of the app and after that fact. Whereas Sony installed the rootkit by simply inserting a CD into your computer.

John, I just had another thought…

This move on Apple’s part may have just handed the keys to the Enterprise kingdom to Blackberry for good. I suspect that a lot of IT managers will now feel even more strongly that the iPhone isn’t a secure platform.

After all, if Apple has built in a back door such that they can snoop what products are running on a phone and even remove them remotely, what’s to stop someone from compromising this channel and taking data instead of turning off applications?

This is a really badly thought out move on Apple’s part and one for which I am now predicting they will pay dearly in the business marketplace.

Oliver

John, I don’t know what plan you are on that you received your phone for free on an 18 month contract as that is not a plan that has been publicized to any degree where I am. However in the case of your device that phone still no longer belongs to Apple. Perhaps it could be argued that it belongs to the carrier but the truth is that if you cancel your service before you complete the contract term you still keep the phone. Perhaps you pay an early termination fee but at no time does the device revert to Apple.

As for “Symbian malware” sure there are lots of links in Google. There are hundreds of millions of Symbian devices out in the wild. Considering the number of Symbian devices the lack of malware has actually been pretty astonishing. Much as F-Secure and other companies would like us to believe that Symbian phones are as much at risk as windows PCs the reality is that there have been virtually no significant problems with malware on mobile devices to date.

Additionally there have been plenty of devices that have built in GPS enabling a third party to locate the phone or the user either with or without that user’s knowledge. Apple hasn’t written these applications and I am willing to bet that the language in the user agreement for the Apps Store and for iTunes absolves Apple of any responsibility for any problems that an end user might have with a third party application.

I don’t believe that people were successful in suing GM or Ford when their vehicles crashed as a result of faulty tires even though those tires had been installed by the manufacturer prior to the consumer taking delivery of the vehicle. No – the liability remained with the tire manufacturer much the same way that the liability for a flawed application would reside with the developer.

It is one thing for Apple to discover a flaw and issue a warning suggesting that the application be removed from the device but quite another for Apple to clandestinely put a mechanism in each device that allowed them to exert post-purchase control over what can or cannot remain on the device particularly considering the fact that what is on the device was likely put their using Apple’s pre determined mechanism for so doing, that Apple was paid for this application (if there was a fee for it) and, as I said initially that Apple no longer owns the device in question.

I also notice that you didn’t respond to my suggestion that this move on Apple’s part is likely the death of this device as a viable enterprise solution. IT managers are not going to tolerate manufacturer back doors into their environments especially back doors that at a minimum can disable or uninstall full applications and god only knows what else.

It is not difficult to imagine that a whole host of other data is being transmitted back to Apple in addition to that about which applications are on a particular device.

Finally, the fact that Apple didn’t disclose this right up front is another very significant indicator that Apple knew that this was not something legitimate nor something that people would appreciate.

If they thought it was then why didn’t they promote it as a safety feature baked right into their handset?

Why didn’t Steve Jobs say something like the following during his keynote at WWDC?

“Security is another issue that we take very seriously at Apple and we have created an additional, unique mechanism to insure that your device remains secure so that you can enjoy the knowledge that if Apple, at any time, learns that any application installed via the App Store is functioning in a way that could compromise the privacy, safety or security of the user or the data on the device, we have a built in mechanism that will allow us to deactivate that malfunctioning code in real time.”

He could have said something like that but he didn’t. Why? Because they didn’t think of it? Or because they knew that lots of people would say “but wait a minute? How would they know what is running on my device? And how could they remotely deactivate a particular application? You know, I’m not so sure I like the idea of Apple acting as big brother on my phone.”

Actually now that I think about it this is an even greater about face then I had realized. Remember Apple’s “1984″ Campaign?

Hasn’t Apple become more like “the establishment” and we like the “huddled masses” mindlessly accepting whatever Apple tells us is cool?

Think about it. Do you really want Apple to know or monitor everything that is going on with your phone? If not, how do you know that they aren’t?

Oliver

@StefTheRef,

Actually, Stef, your comment demonstrates a lack of comprehension of my article rather than my inability to understand what is happening with the handset..

I never said anything in my article about the signal provider (who would typically be AT$T with a locked, US Phone) nor was I talking about wiping a device that has “gone missing’.

Both of these facets of mobile device operation and management are well known and generally accepted by end users and corporate IT managers. Instead what I was writing about, and what you failed to grasp correctly – was Apple’s “baked in” ability to selectively kill any application running on the device that they choose to kill.

This “killing’ of an application could take place regardless of whether the device was listed as missing or not, regardless of whether the device was locked or unlocked and regardless even of whether the application in question was purchased, downloaded for free, and even if it was downloaded via Apple’s “Official Channel’ the iPhone App Store.

Contrary to your contention that my “unfounded rant” fails to describe the general consensus view of corporate IT managers about this previously undisclosed capability that Apple left for itself – it is a specific reason cited by a number of such individuals as to why they do not allow the device to be part of their corporate networks..

You see, unlike wiping a missing device, which is an executable command that causes a device to erase all data and does not require any server side knowledge of what is on the device, Apple’s ability to kill a particular application requires that Apple knows that said application is resident on the phone. This means that by default the device is either reporting back to Apple via an undisclosed data conduit or that Apple has the ability to remotely probe devices to check for apps that they’ve decided to disallow. Neither of these circumstances is acceptable to security conscious IT administrators when it comes to their networks or the gear that accesses them.

In the future, if you’re going to accuse a writer of failing to comprehend his or her subject matter, do yourself the favor of at least reading the article in its entirety and being sure that YOU UNDERSTAND WHAT WAS WRITTEN, before you take exception to it and then prove by virtue of your critical comment that it is your thought processes that have failed to be coherent and that you haven’t the faintest idea what you are talking about..

Oliver Starr

PS: I hope you are not one of the aforementioned corporate IT managers because if you are and your capabilities are evidenced by your comment and misunderstanding of the danger inherent in Apple’s “kill switch” security flaw, your network, your job, or both are in grave danger.

There’s some great tips there, just blogged about it too!