Blessed ZipperDown, Who Unzipped the Apps

Patron of iOS apps downloaded in a hurry, files fetched without encryption, and people who open archives without looking inside.

Life

In May 2018 Pangu Lab flagged ZipperDown, a recurring mistake pattern found in thousands of iOS apps. It wasn't a single bug but a wrong way of downloading and unpacking resources: on an attacker-controlled network, a swapped archive could write files outside the intended folder and, from there, hijack the app's behaviour. Being an error pattern rather than a single CVE, he remains blessed.

Prayer

O Blessed ZipperDown, who unzips where you should not, let our apps download safely and check their paths. Amen.

How to celebrate

Celebrated by fetching resources over HTTPS only and verifying that no file escapes its own folder.

Unzip on the wrong network, and the app lies wide open.