Related papers: Taking a Bite Out of the Forbidden Fruit: Characterizing Third-Party Iranian iOS App Stores

Taking a Bite Out of the Forbidden Fruit: Characterizing Third-Party Iranian iOS App Stores

URL: http://arxiv.org/abs/2604.26343v1
Date: Wed, 29 Apr 2026 06:50:32 GMT
Title: Taking a Bite Out of the Forbidden Fruit: Characterizing Third-Party Iranian iOS App Stores
Abstract summary: Iranian iOS users are barred from accessing the Apple App Store and developer services.<n>Despite violating Apple's developer terms, a thriving underground ecosystem of third-party iOS app stores has emerged to serve Iranian users.<n>This paper presents the first comprehensive empirical study of these clandestine app stores.
Score: 4.132349063771989
License: http://creativecommons.org/licenses/by/4.0/
Abstract: Due to U.S. sanctions and strict internet censorship, Iranian iOS users are barred from accessing the Apple App Store and developer services. In response, despite violating Apple's developer terms, a thriving underground ecosystem of third-party iOS app stores has emerged to serve Iranian users. This paper presents the first comprehensive empirical study of these clandestine app stores. We document how these stores operate, including their distribution mechanisms, user authentication processes, and evasion techniques. By collecting and analyzing more than 1700 iOS application packages and their metadata from three major Iranian third-party app stores, we characterize the ecosystem's size, structure, and content. Our analysis reveals a significant presence of Iranian-exclusive apps, widespread distribution of cracked apps, unauthorized monetization of paid content, and embedded third-party tracking and piracy libraries. We also uncover a notable overlap among financial, navigational, and social apps that exist solely in this ecosystem, reflecting the unique digital constraints of Iranian users. Finally, we quantify the potential revenue losses for developers due to piracy and document security and privacy risks associated with altered binaries. Our findings highlight how sanctions, censorship, and enforcement gaps have enabled a parallel app distribution ecosystem with complex socio-technical implications.

Related papers

TENET: Telegram Mini App (in)security [2.1793134762413433]
Many Mini Apps store authentication materials, exposing users to unauthorized access, impersonation, and financial exploitation.<n>We present TENET, a purpose-built auditing tool whose design decisions are grounded in the structural properties of the secrets targeted.<n>We propose mitigation measures and best practices for both Telegram platform developers and third-party Mini App creators.
arXiv Detail & Related papers (2026-08-18T08:59:03Z)
Stealing Reasoning Traces from Proprietary LLM APIs [84.58379404903394]
We develop a scalable decryption jailbreak for encrypted reasoning traces.<n>It circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning.<n>It inadvertently reveals hazardous information hidden within the reasoning process.
arXiv Detail & Related papers (2026-08-10T17:24:50Z)
Exploring Privacy Leakage and Data Disclosure Violations in the MacOS Application Ecosystem [10.513610661903577]
We study the mechanisms designed to regulate and disclose data collection and sharing practices in the ecosystem.<n>We find that desktop apps are being leveraged by online trackers to enrich user profiles and device fingerprints.<n>We propose a series of mitigations that aim to both streamline the data disclosure process for developers and improve Apple's app vetting process.
arXiv Detail & Related papers (2026-08-05T23:46:39Z)
Supply Chain Insecurity: Exposing Vulnerabilities in iOS Dependency Management Systems [3.8870795921263728]
Dependency management systems are a critical component in software development, enabling projects to incorporate existing functionality efficiently.<n>Despite the widespread use of smartphone apps, the security of dependency management systems in the iOS software supply chain has received limited attention.<n>We focus on CocoaPods, one of the most widely used dependency management systems for iOS app development, but also examine the security of Carthage and Swift Package Manager.
arXiv Detail & Related papers (2026-01-28T14:27:14Z)
ARMOR: Aligning Secure and Safe Large Language Models via Meticulous Reasoning [64.32925552574115]
ARMOR is a large language model that analyzes jailbreak strategies and extracts the core intent.<n> ARMOR achieves state-of-the-art safety performance, with an average harmful rate of 0.002 and an attack success rate of 0.06 against advanced optimization-based jailbreaks.
arXiv Detail & Related papers (2025-07-14T09:05:54Z)
Beyond App Markets: Demystifying Underground Mobile App Distribution Via Telegram [23.638100691705482]
This study provides the first comprehensive exploration of the underground mobile app ecosystem on Telegram. Our findings reveal the significant prevalence of these apps on Telegram, with the total sum of subscription user numbers promoting these apps equivalent to 1% of Telegram's user base. Our analysis also exposes the misuse of iOS features for app distribution and the prevalence of malicious behaviors in these apps.
arXiv Detail & Related papers (2024-08-06T23:55:39Z)
Knowledge-to-Jailbreak: Investigating Knowledge-driven Jailbreaking Attacks for Large Language Models [86.6931690001357]
knowledge-to-jailbreak aims to generate jailbreaking attacks from domain knowledge.<n>We collect a large-scale dataset with 12,974 knowledge-jailbreak pairs.<n>Experiments show that jailbreak-generator can generate jailbreaks comparable in harmfulness to those crafted by human experts.
arXiv Detail & Related papers (2024-06-17T15:59:59Z)
JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models [123.66104233291065]
Jailbreak attacks cause large language models (LLMs) to generate harmful, unethical, or otherwise objectionable content. evaluating these attacks presents a number of challenges, which the current collection of benchmarks and evaluation techniques do not adequately address. JailbreakBench is an open-sourced benchmark with the following components.
arXiv Detail & Related papers (2024-03-28T02:44:02Z)
A StrongREJECT for Empty Jailbreaks [72.8807309802266]
StrongREJECT is a high-quality benchmark for evaluating jailbreak performance. It scores the harmfulness of a victim model's responses to forbidden prompts. It achieves state-of-the-art agreement with human judgments of jailbreak effectiveness.
arXiv Detail & Related papers (2024-02-15T18:58:09Z)
SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices [67.65883495888258]
We present SyzTrust, the first state-aware fuzzing framework for vetting the security of resource-limited Trusted OSes. SyzTrust adopts a hardware-assisted framework to enable fuzzing Trusted OSes directly on IoT devices. We evaluate SyzTrust on Trusted OSes from three major vendors: Samsung, Tsinglink Cloud, and Ali Cloud.
arXiv Detail & Related papers (2023-09-26T08:11:38Z)
Demystifying Removed Apps in iOS App Store [0.0]
This paper takes the initiative to conduct a large-scale and longitudinal study of removed apps in the iOS app store. Our analysis reveals that although most of the removed apps are low-quality apps, a number of them are quite popular.
arXiv Detail & Related papers (2021-01-13T14:34:26Z)
Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
arXiv Detail & Related papers (2020-06-10T16:05:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.