Podcast
Root Causes 345: Apple Versus European Sideloading


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
December 5, 2023
The European Union is applying pressure to Apple to allow sideloading of applications. We go over why this is occurring, the potential dangers, and Apple's response.
Podcast Transcript
Lightly edited for flow and brevity.
So, we’ve talked about sideloading in the past. Jason, what’s the two or three description of sideloading?
Apple holds everything very close to their chest and as of right now, there is no official way to run an app on your iPhone without it coming from the Apple App Store.
And why? Why? Why is that? And it’s because Apple feels – and I think this is not a bad thought by Apple at all – they can do a lot of protection for their ecosystem and not put potentially malicious applications into the app store.
It’s because Apple takes this really seriously and even if it was a white hat who had no intention of hurting anyone, they take it awful seriously.
Now, here’s the thing. Let’s compare and contrast. Is it perfect? Well, I think it’s a lot better than the alternative and here’s the thing. You, Tim, if you were to go and do an internet search right now on mobile device malware, where does it mostly reside? Well, it mostly resides in the world of sideloading, which exists in Android systems.
You can remove the default setting of, hey, you can only go to the Google Play and get applications, you can sideload an Android device and what has that resulted in? Well, there have been, Tim, lots and lots of fraud attacks against people holding Android devices where you might be texted a link to a Java APK file and you basically install it, which is a way of sideloading an application and if your system is set to allow sideloading on an Android device, you now have a piece of malware which might do something such as SMS redirection.
Now as white hat researcher back in my day, I did that within about ten minutes. It was extremely to do that. And bad guys know it. Apple’s world doesn’t allow that.
Now can you potentially jailbreak iPhones? You know, iOS devices? Well, yes. Jailbreaking has been around a long time. It takes advantage of flaws within iOS and generally – generally – you have to choose to jailbreak your device. I mean, obviously, again, you can do a Google search and there have been non-informed or basically malicious jailbreaks of people’s devices so that the security features of the iPhone are rendered less or whatever.
The ability to listen to a microphone or look through the camera or sideload applications. Those things have all been done with iOS. But those aren’t things that you typically choose to do. Some people choose to jailbreak their devices and they have other reasons to do that but I’m just trying to compare and contrast a walled garden, an official walled garden vs. the easy ability to sideload applications at will. And the Android world has always been seen as being more open but there’s risks involved with that and I think what’s interesting here, Tim, is the EU is basically saying look - - I’m gonna paraphrase everything here and I might get this not completely correct but forgive me because I think this is the spirit of it. Apple’s walled garden is looked at as being anticompetitive in a way.
Apple looks at that and says that’s kind of scary. We’ve worked so hard in the history of iOS to make sure that we’ve got this super clean, controlled walled garden that really has protected our users. It very, very objectively has protected people.
Well, (a) to break anticompetitive behavior. Right? We can debate all day whether that’s good or bad but (b) what happens if European Union says, hey, you know what? There’s an app you must have. We are going to dictate you must have this X app and if a U.S. based tech company – Apple of course – doesn’t want that app to be on your phone or it’s not on the app store, tough. You will sideload it from us.
So, Tim, just a few extra comments about this. The reason why this has come up – it has been talked about previously. Right? So Craig Federighi, one of the executives at Apple, basically he was the one talking about that Apple may be forced to do this by European law and what’s interesting is Apple might comply with this, but Apple apparently is considering the idea of still maintaining certain security requirements even if the software is distributed outside of its store.
So, therefore, there is still some sort of verification that could still be required by Apple even if you are in the EU and are under this jurisdiction that’s gonna force this by law and apparently what apple is saying is look, because of the fact that we are gonna have to verify this app side of our app store, this could carry a fee for developers because of the fact that it’s gonna cost us extra work to do this outside of the normal means. So, Apple might still try to maintain some kind of control just for security purposes. But here is the bottom line is there may be iOS devices sold in Europe that allow sideloading that are not sold in North America or other jurisdictions where sideloading is not required. So it might – might – end up creating two classes of iOS devices and what happens of course when inevitably you have sideloading capable devices that slip into other jurisdictions. What does that even mean?
Yeah and if you want to hear more about sideloading, our <a href="/root-causes/root-causes-162-what-is-sideloading">Episode 162</a>, What is Sideloading? Can give you more on that topic in particular. So, that’s a good thing to go back and listen to.

