Steal app and post it on AppStore using ad-hoc distribution

Question

I am going to ask users on public forums to take part in my app beta testing using ad-hoc method. So if user interested in testing/reviewing he sends me UUID and I send him app binary.

The main question: is it safe to give anyone app binary file? I heard some terrible stories on Apple iphone developer forums that some guy found his app published someone else using another company name and different icon. So the app was absolutely the same except company name and graphics. He told that someone else got his app binary, cracked it and post it on appstore for profit.

So is it possible to steal my app and publish it on appstore if I give my app binary using ad-hoc?

thx

Answer 1

I've never heard of code that can't be decompiled/disassembled. I guess this applies to iPhone as well. So yes.

Answer 2

Yes, as it is possible for the same to occur for apps that are in the app store.

There are tools that can unpack the signed binaries which can then be repacked.

In the same light, someone could crack Visual Studio to show a different company name and then release it as their own.

In both cases, there are serious legal ramifications, and in both cases it is actually very rare to occur.

In the case of iPhone apps, it is very unlikely someone would want to bother stealing your app. If you really think there is a risk, I wouldn't recommend sending ad-hoc copies to random people you don't know.

Answer 3

Yes, technically they can take the binary and resign it using their keys. They could do that either to install it on their device, or submit it to the store.

They won't have the source, so making any sort of fixes or changes (including to deal with a submission rejection) would be remarkably difficult, and it should not be to hard to prove a copyright violation and get it taken down (though you might need to pay some lawyers).

At the end of the day I wouldn't worry about it... this sort of thing just doesn't happen in practice.

Answer 4

While it is technically possible, (IANAL) I believe such an act is a violation of the DMCA, giving you legal ground to go after them, any and all profits they make off of what they stole, etc.

Answer 5

If you feel that threatened, you can add an "expiration system" to your app. Check if the date is later that, say November 2009 and kill it. I don't think someone will go into the trouble of removing your code signing, signing it with his own identity after he has cracked the expiration failsafe. You app should be pretty awesome.