Malware: It could happen to iOS too.

Some of you who read my post about Android malware may be thinking that iOS is safer. "A walled garden" as it is called where you can only download apps from one place must be safe... right? Unfortunately, that is not the case.

As of May 2nd 2013, an app from the app store was identified as malware by Bit defender Virus Scanner, a free app available from the Mac App Store. It has been confirmed that this is not a false positive, and the app actually contained a JavaScript Trojan Horse. This means that the app was infected with a string of malware that did not spread aside from downloading the infected app. The string of text in question is an iframe, which embeds a remote website. So if this iframe was read on a Mac, the iframe could lead you to the website that is embedded in the code of the app. And if the website in question is malicious, your mac is infected without you even doing anything except plugging your iOS device into your Mac and playing an MP3 file in the app.

As of this writing, the website that the string leads to is not responding.

Note that this malware is not a cause for concern at this point. And no, I am not trying to scare you.

But as someone who keeps his eye out for malware, it shows how Apple's process for app screening has room for improvement. Testing in a sandbox to watch the app's real world activities would almost certainly detect any malware or malcode in the app. But as it is unknown what the screening and approval process is, it is unknown if something did not work or something that should have been done did not get done.

Let me state that the app in question, which I will not name, is completely harmless at this point. Because at this point, there is no content in the website where the app points to. So this could possibly be an example of poor coding practices.

You can think whatever you would like about the app, but bottom line is that something sketchy is going on, but we don't know what. Was this code injected into the app by someone with malicious intent, or was it a poor coding practice used by the app developer? That question still remains.

I certainly hope that it was just a poor coding practice by the developer, after all, a false alarm is my favorite kind of alarm.

Comment below with your take on this. Is it malware that may or may not have been put there intentionally, or is it a poor coding practice?