https://www.google.com/amp/s/www.macrumors.com/2015/09/20/xc... shows 500 million infected from 50 apps.
> You're assuming that Apple doesn't do this?
No need to assume. https://researchcenter.paloaltonetworks.com/2015/09/more-det... not only shows that there were thousands more apps affected by Xcodeghost than originally reported (and thus, more infected users than the approximately 500 million estimate from the earlier link based on the original 50 apps), but also that Apple was still taking down affected apps days later, waiting for third parties to report them. This despite that Xcodeghost represents a single malware that can be detected with a binary grep. That Apple didn't have the infrastructure to deal with even that demonstrates how woefully inadequate their app management infrastructure is for dealing with malware.
Where does the link say this? As far as I know Apple has all the information needed to make this decision themselves. As you said, a binary grep, coupled with many of Apple's static/dynamic analysis tools should be enough to find this issue.
"Starting September 18, Apple began to remove some iOS apps infected by XcodeGhost from its App Store.... As of this writing, on Monday, September 21, we notice that there are still some previously known infected iOS apps available in App Store."
> As you said, a binary grep, coupled with many of Apple's static/dynamic analysis tools should be enough to find this issue.
As I said, it should be so simple if Apple had set up the basic infrastructure for this. Since it had not, Xcodeghost remained on the App Store long after it was initially discovered, allowing researchers to find thousands more affected apps. Compare to Google's Play Store which not only performs static analysis but also crash analysis, battery usage analysis, and dynamic analysis through running the apps in cloud VMs (something Amazon did at launch).
> Compare to Google and Amazon, which run static and dynamic analysis of apps uploaded to their stores and allow third party security research on their stores, enabling both earlier detection of malware and faster takedown of all apps that share the same malware.
You're assuming that Apple doesn't do this?