https://www.usenix.org/system/files/conference/usenixsecurity13/sec13-paper_wang_2.pdf
Het blijkt mogelijk om apps in de appstore te krijgen die volledig gereviewd zijn door Apple maar toch kwaardaardige dingen kunnen.

Oftwel, ff oppassen met wat je download, niet al te vage dingen en hopen dat Apple dit snel fixed


Apple adopts the mandatory app review and code signing mechanisms to ensure that only approved apps can run on iOS devices. In this paper, we present a novel
attack method that fundamentally defeats both mechanisms. Our method allows attackers to reliably hide malicious behavior that would otherwise get their app rejected by the Apple review process. Once the app passes  the review and is installed on an end user’s device, it can
be instructed to carry out the intended attacks.
The key idea is to make the apps remotely exploitable and subsequently introduce malicious control flows by rearranging signed code. Since the new control flows do not exist during the app review process, such apps, namely Jekyll apps, can stay undetected when reviewed
and easily obtain Apple’s approval.
We implemented a proof-of-concept Jekyll app and successfully published it in App Store. We remotely
launched the attacks on a controlled group of devices that installed the app. The result shows that, despite running inside the iOS sandbox, Jekyll app can successfully perform many malicious tasks, such as stealthily posting tweets, taking photos, stealing device identity information, sending email and SMS, attacking other apps, and even exploiting kernel vulnerabilities.