Researchers have discovered a way in which Apple's iOS can be exploited to slip past the App Store approval process.
Georgia Institute of Technology researchers used what they call 'Jekyll apps' which can allow hackers to reliably hide malicious behaviour that would otherwise get their app rejected by the Apple review process.
The researchers said that by rearranging the signed code apps can be remotely exploited and subsequently malicious control flows can be introduced and since the new control flows do not exist during the app review process, such apps can stay undetected when reviewed and easily obtain Apple's approval, the Guardian reports.
The security researchers had earlier discovered two security weaknesses that permit installation of malware onto Apple mobile devices with the use of seemingly innocuous applications and peripherals, uncovering significant security threats to the iOS platform.
Despite running inside the iOS sandbox, a Jekyll-based app can successfully perform many malicious tasks, such as posting tweets, taking photos, sending email and SMS, and even attacking other apps - all without the user's knowledge.
Apple spokesperson Tom Neumayr said that the company has since made some changes to the iOS software in response to issues identified in the research, which has a section discussing possible counter-measures to this kind of malware.
One of the researchers, Tielei Wang said that it is not easy for Apple to fix the vulnerabilities created and exploited by them adding that the company can use better sandbox policies to refine what the researchers can do.
