Pirated software has pricked the profits of many a software maker, but up until now other enterprises haven’t seen piracy as something that could harm them. Yet, pirated apps can contain modified segments of code that can carry malware and spyware into the enterprise via counterfeit software purchases or apps on employee smartphones.
“A big concern regarding pirated apps – beyond the simple fact that they are pirated – is that the majority of the malicious code for mobile devices we see today are Trojanized legitimate apps,” says Khoi Nguyen, senior product manager, Enterprise Mobility Group at Symantec. “These are essentially pirated apps that have had malicious code added to them in the process, then reposted to third-party app hosting sites, even sometimes to official app markets.”
Odds are that at least some of your employees are walking malicious code right into your enterprise without you – or them – ever realizing it.
“So, in terms of enterprise concerns over pirated apps, this should be a big one,” says Nguyen.
This situation is difficult for enterprises to counter but the problem absolutely cannot be left to the software manufacturers and app developers to solve.
While manufacturers strike hard at pirates that sell counterfeit copies as Microsoft recently did against a bootlegger in Australia, experts agree that litigation is unlikely to stop piracy, especially piracy with the intent to infiltrate enterprises.
Mobile app developers tend to be savvy enough to know that litigation isn’t the answer and many just try to make the best of a bad situation.
"We don’t worry about pirates most of the time,” says Paul O’Connor, co-founder and brand manager for Appy Entertainment, an established developer for iPhone, iPad, and Android. “We love all our players, even the pirates, and we’re convinced that everyone who downloads our games will someday become paying customers."
But not every developer can absorb the costs of piracy.
“App piracy is definitely a problem for app developers,” says iOS Developer Nick Dalton. “I've seen numbers from developers who track their apps, reporting that 90% of their users did not pay for their app. If the app makes use of server resources that the developer has to pay for, then having 90% freeloaders is a huge problem.”
Dalton says the best way developers can counter piracy on the iPhone/iPad platform is to use Apple’s In-App Purchase feature. “The app itself is given away for free and then the customer has to use In-App Purchase to unlock most features in the app,” he says. “Correctly implemented, this makes the app much more difficult to pirate.” He says that Google has also made In-App Billing available on the Android platform for the same reason.
Such measures make it more difficult to pirate apps, but it’s far from impossible. Developers at Gamelab 2011 in Barcelona recently complained that in-app purchasing on Android is easily pirated. And there’s talk among iOS developers of creating an exploit that will jailbreak iOS 5 to end pirated apps but they’re wondering if users will object to being locked out of pirated freebies.
“The DRM applied by Apple to all apps in their App Store is pretty weak, although I'm told that it's pretty good compared to the protection for Android and WebOS apps,” says Dalton. “As a consequence of this there are scripts and easy to follow instructions to remove the DRM protection from an app. Thus it's not difficult to find pirated versions of apps online.”
Some developers try to counter all this by requiring a “digital receipt” from the app store to activate the app or by flashing messages on a detected pirated copy asking the user to buy the app. But preventative or curative tactics fall woefully short in effectiveness. Unfortunately, there’s little else developers can do.
“Nobody I know believes it's worth the trouble to add piracy detection on top of what Apple and Google provide,” says software engineer Bryce Kerley. The development of these features costs more money than the conversions from pirated to legit copies would yield, and ‘zinging’ or acting against pirates would present a support and legal nightmare.”
So, dear enterprise leader, you are pretty much on your own in fighting off this particular threat. What can you do?
First, educate your employees and vendors. They honestly don’t know about this threat so they will keep doing what they’re doing until they understand what it is they’re really doing.
Second, create and enforce a strong mobile and download policy and provide employees with a list of approved apps and App stores.
Third, require the installation of mobile security and anti-virus programs on all devices whether corporate or private owned.
“An enterprise can also distribute applications over an Ad-Hoc method and scan the applications before they're distributed to ensure source file/distributable consistency,” says Jordan Edelson, CEO of NYC-based Appetizer Mobile, a full-service mobile solutions agency that has developed apps for such notables as Lady Gaga, NBA, Kim Kardashian, and two apps featured on the latest iPad commercials.
“They can also create other systems to partition access to different layers of enterprise level information, essentially creating a level of barriers that require their own sets of authorization before making a connection to enterprise data,” he adds.
