Elie Bursztein, a researcher at Google, is reporting that Apple only recently fixed a massive security loop hole on the AppStore.
“Early July 2012, I reported to Apple numerous vulnerabilities related to their App Store iOS app. Last week Apple finally issued a fix for it and turned on HTTPS for the App Store,” Elie Bursztein. “I am really happy that my spare-time work pushed Apple to finally enabled HTTPS to protect users. This post discuss the vulnerabilities I found. As a bonus, I made several video demos of the attacks described in this post so you can see by yourself how dangerous not having full HTTPS is.”
According to Bursztein, “the Apple App Store and associated applications, such as the Newsstand, are native applications provided by default with iOS to access/purchase content from the Apple App Store.”
Here is a list of attacks Burstein believes could have been carried on the AppStore due to a lack of encryption (HTTPS):
I assume Apple’s security guys are thinking, “better late than never.”