iOSModZoo: A Large-Scale Study of Third-Party iOS App Markets

Abstract

Sideloading apps in iOS is possible without a jailbroken (rooted) device despite its 'walled garden' reputation. We found 89 third-party app markets and present the first overview of the modded app ecosystem on iOS. We collected and analysed apps from the 9 most popular modded markets over 11 months. We found 29% of the modded apps are pirated paid apps offered for free with a reported 1.12 billion downloads across just three markets, likely affecting developer revenue. Many modded apps offer subscription features and in-app or in-game items for free: 69% of modded apps originally had in-app purchases in the App Store. In terms of user security, VirusTotal classified over 1% of modded apps as malicious (CVE, exploits, trojans, mainly), versus less than 0.03% of App Store apps. Markets sign 78% of the modded apps with enterprise certificates, while others rely on device management profiles meant for company devices which can extract private user data and remotely install apps.