> it’s a good idea to double check if the App is compiled with the library-validation option (flag=0x200). That would mean that the OS will verify if all dylibs are signed or not
Actually, library validation will check if the binary is signed with the same team ID.
> I signed up with a new Apple ID for the Apple developer program just because I had the fear that they will ban me, once I introduce an app that can be used for private escalation. In fact they didn’t.
Apple has a history of going after people who try to find holes in the App Store’s security model. This was a huge gamble; they could have your life quite miserable if they figured out who was behind this.
He had an open unpublished conversation with Apple Security and notified them of his own published app, so “if they figured out who” seems inapplicable here.
4 comments
[ 1.8 ms ] story [ 12.9 ms ] threadActually, library validation will check if the binary is signed with the same team ID.
> I signed up with a new Apple ID for the Apple developer program just because I had the fear that they will ban me, once I introduce an app that can be used for private escalation. In fact they didn’t.
Apple has a history of going after people who try to find holes in the App Store’s security model. This was a huge gamble; they could have your life quite miserable if they figured out who was behind this.