Recognition: unknown
Taking a Bite Out of the Forbidden Fruit: Characterizing Third-Party Iranian iOS App Stores
Pith reviewed 2026-05-07 12:55 UTC · model grok-4.3
The pith
Iranian third-party iOS stores distribute cracked apps and exclusive tools to users barred from the official App Store.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
By collecting and analyzing more than 1700 iOS application packages and their metadata from three major Iranian third-party app stores, the study characterizes an ecosystem that supplies Iranian-exclusive apps, distributes cracked software, enables unauthorized monetization of paid content, and embeds third-party tracking and piracy libraries, while documenting revenue losses for developers and security and privacy risks from altered binaries.
What carries the argument
Collection and analysis of 1700+ iOS app packages plus metadata from three selected third-party stores, used to identify distribution mechanisms, authentication steps, evasion methods, app categories, and embedded libraries.
If this is right
- A notable share of apps exists only in this ecosystem and covers financial, navigational, and social needs shaped by local constraints.
- Cracked apps and unauthorized monetization create direct revenue losses for original developers.
- Embedded tracking and piracy libraries plus altered binaries introduce measurable security and privacy risks for users.
- Stores rely on specific user authentication and evasion techniques to keep operating under sanctions and censorship.
Where Pith is reading between the lines
- Parallel underground app stores could form in other countries facing similar sanctions or app store blocks.
- App developers may need targeted protections against piracy that work across official and unofficial distribution channels.
- The findings suggest sanctions can indirectly foster new digital economies with their own technical and legal challenges.
Load-bearing premise
The three selected stores stand in for the full underground ecosystem and the gathered apps and details match what actual users encounter.
What would settle it
Repeating the collection across additional Iranian third-party stores and finding substantially less piracy, fewer exclusive apps, or no overlap in financial and social categories would undermine the characterization.
Figures
read the original abstract
Due to U.S. sanctions and strict internet censorship, Iranian iOS users are barred from accessing the Apple App Store and developer services. In response, despite violating Apple's developer terms, a thriving underground ecosystem of third-party iOS app stores has emerged to serve Iranian users. This paper presents the first comprehensive empirical study of these clandestine app stores. We document how these stores operate, including their distribution mechanisms, user authentication processes, and evasion techniques. By collecting and analyzing more than 1700 iOS application packages and their metadata from three major Iranian third-party app stores, we characterize the ecosystem's size, structure, and content. Our analysis reveals a significant presence of Iranian-exclusive apps, widespread distribution of cracked apps, unauthorized monetization of paid content, and embedded third-party tracking and piracy libraries. We also uncover a notable overlap among financial, navigational, and social apps that exist solely in this ecosystem, reflecting the unique digital constraints of Iranian users. Finally, we quantify the potential revenue losses for developers due to piracy and document security and privacy risks associated with altered binaries. Our findings highlight how sanctions, censorship, and enforcement gaps have enabled a parallel app distribution ecosystem with complex socio-technical implications.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper presents the first comprehensive empirical study of third-party Iranian iOS app stores that emerged due to U.S. sanctions and internet censorship. It documents their operation, distribution mechanisms, authentication, and evasion techniques, then analyzes over 1700 app packages and metadata from three major stores to characterize ecosystem size, structure, and content, including Iranian-exclusive apps, cracked apps, unauthorized monetization, embedded tracking/piracy libraries, category overlaps, revenue losses from piracy, and security/privacy risks from altered binaries.
Significance. If the sampling and collection hold, the work offers valuable empirical grounding for an understudied underground ecosystem shaped by geopolitical constraints, with the scale of 1700+ apps providing concrete data on piracy prevalence, tracking libraries, and risks. It contributes to socio-technical understanding of parallel app distribution under sanctions and censorship, highlighting implications for developers, users, and policy.
major comments (3)
- [Abstract] Abstract: the claim that the three stores are 'major' and the study 'comprehensive' for characterizing the full ecosystem lacks any selection criteria, total count of Iranian third-party stores, or coverage estimate; without this, distributions of exclusive apps, cracked apps, and revenue losses cannot be extrapolated beyond the sampled stores.
- [Methods / Data Collection] Data collection and methods: the abstract provides no details on collection methods, authentication evasion analysis, binary alteration detection, or statistical controls for overlaps/revenue calculations; these validation steps are load-bearing for the descriptive claims about widespread cracked apps and risks.
- [Results] Results on ecosystem characterization: the central generalization to 'the ecosystem's size, structure, and content' rests on the untested assumption that the three stores are representative; no comparison to other stores or sideload channels is described, creating a selection-bias risk for claims about Iranian-exclusive apps and monetization.
minor comments (2)
- [Abstract] Abstract: add one sentence summarizing the high-level methodology (e.g., how apps were collected and analyzed) to orient readers before the findings.
- [Results] Throughout: ensure every 'widespread' or 'significant' claim is accompanied by exact counts or percentages from the 1700+ apps rather than qualitative statements.
Simulated Author's Rebuttal
We thank the referee for their constructive and detailed feedback. We have addressed each major comment point by point below, with revisions to improve precision on sampling scope, methodological transparency, and avoidance of overgeneralization. The changes will strengthen the manuscript without altering its core empirical contributions.
read point-by-point responses
-
Referee: [Abstract] Abstract: the claim that the three stores are 'major' and the study 'comprehensive' for characterizing the full ecosystem lacks any selection criteria, total count of Iranian third-party stores, or coverage estimate; without this, distributions of exclusive apps, cracked apps, and revenue losses cannot be extrapolated beyond the sampled stores.
Authors: We agree the abstract uses 'major' and 'comprehensive' without sufficient qualification. The full paper (Section 3) explains that the three stores were identified as the most prominent through reconnaissance of Iranian online forums, search engines, and user-reported distribution channels; they were selected based on the volume of apps hosted and frequency of mentions. Due to the underground nature of the ecosystem, no exhaustive list or total count exists. We will revise the abstract to state that the study examines three prominent stores and add an explicit limitations subsection noting that findings apply to these stores and that extrapolation to the full ecosystem is not warranted. This directly addresses the concern about unsupported generalization of distributions and revenue estimates. revision: yes
-
Referee: [Methods / Data Collection] Data collection and methods: the abstract provides no details on collection methods, authentication evasion analysis, binary alteration detection, or statistical controls for overlaps/revenue calculations; these validation steps are load-bearing for the descriptive claims about widespread cracked apps and risks.
Authors: The manuscript's Methods section (Section 4) already details the collection process, authentication techniques, binary alteration detection via checksum comparison and decompilation, and statistical handling of overlaps and revenue calculations. We accept that the abstract is insufficiently informative on these points. We will expand the abstract with a concise high-level description of the empirical pipeline and add a short validation paragraph in the results to reinforce the claims on cracked apps and risks. No new data collection is required. revision: partial
-
Referee: [Results] Results on ecosystem characterization: the central generalization to 'the ecosystem's size, structure, and content' rests on the untested assumption that the three stores are representative; no comparison to other stores or sideload channels is described, creating a selection-bias risk for claims about Iranian-exclusive apps and monetization.
Authors: We recognize the selection-bias risk and will revise all instances of 'the ecosystem' in the abstract, results, and conclusion to refer specifically to the three studied stores. The paper focuses on store-based distribution because it involves the authentication and evasion mechanisms under study; direct sideload channels fall outside this scope. We will add a limitations discussion acknowledging that other channels exist and that representativeness cannot be verified without additional data. No comparisons were performed, as they would constitute a separate study. revision: yes
- Exact total count of Iranian third-party iOS app stores or quantitative coverage estimate, which is unknowable given the clandestine and dynamic nature of the ecosystem.
Circularity Check
No circularity: purely empirical characterization from direct data collection
full rationale
The paper performs an observational study by collecting and inspecting >1700 app packages and metadata from three stores. No equations, fitted parameters, predictions, uniqueness theorems, or ansatzes appear in the provided text or abstract. All claims (ecosystem size, cracked-app prevalence, tracking libraries, revenue loss) are stated as direct results of the collected artifacts rather than reductions to prior self-citations or self-definitions. The representativeness of the three stores is an external sampling limitation, not a circular step inside any derivation chain. The work is therefore self-contained against its own inputs.
Axiom & Free-Parameter Ledger
axioms (2)
- domain assumption The three chosen stores represent the major players in the Iranian third-party iOS ecosystem
- domain assumption Analysis of collected app packages and metadata accurately identifies cracked apps, tracking libraries, and exclusive content
Reference graph
Works this paper leans on
-
[1]
abcnews. 2026. Executions of protesters in Iran surge since start of war, human rights groups say. https://abcnews .com/ International/executions-protesters-iran-surge-start-war-human- rights/story?id=132250133 (Accessed on 26/04/2026)
2026
-
[2]
ajinabraham. 2025. MobSF. https://github .com/MobSF/Mobile- Security-Framework-MobSF (Accessed on 08/04/2025)
2025
-
[3]
Al Jazeera. 2025. Iran blocks Instagram, Telegram after protests. https://www .aljazeera.com/news/2017/12/31/iran-blocks- instagram-telegram-after-protests/ Accessed on 07/13/2025
2025
-
[4]
M. Ali, M. E. Joorabchi, and A. Mesbah. 2025. Same App, Different App Stores: A Comparative Study. In2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft). doi:10.1109/MOBILESoft.2017.3
-
[5]
AltStore. 2025. AltStore. https://altstore .io/ (Accessed on 07/25/2025)
2025
-
[6]
Apple Inc. 2025. 2024 App Store Transparency Report. https: //www.apple.com/legal/more-resources/docs/2024-App-Store- Transparency-Report.pdf (Accessed on 06/10/2025)
2025
-
[7]
Apple Inc. 2025. About alternative app distribution in the Euro- pean Union. https://support .apple.com/en-us/118110 (Accessed on 06/10/2025)
2025
-
[8]
Apple Inc. 2025. App Review. https://developer .apple.com/distribute/ app-review/ (Accessed on 06/10/2025)
2025
-
[9]
Apple Inc. 2025. App Review Guidelines. https://developer.apple.com/ app-store/review/guidelines/ (Accessed on 06/10/2025)
2025
-
[10]
Apple Inc. 2025. App Store Connect. https://developer.apple.com/app- store-connect/ (Accessed on 06/10/2025)
2025
-
[11]
Apple Inc. 2025. Apple Developer Enterprise Program. https:// developer.apple.com/programs/enterprise/ (Accessed on 06/10/2025)
2025
-
[12]
Apple Inc. 2025. Apple Developer Program - Membership Details. https://developer.apple.com/programs/whats-included/ (Accessed on 06/10/2025)
2025
-
[13]
Apple Inc. 2025. Apple Developer Program License Agree- ment. https://developer .apple.com/support/terms/apple-developer- program-license-agreement/ (Accessed on 07/21/2025)
2025
-
[14]
Apple Inc. 2025. Apple ID (or Apple Account). https:// support.apple.com/guide/itunes/aside/glos1009407f/windows (Ac- cessed on 06/10/2025)
2025
-
[15]
Apple Inc. 2025. Beta testing made simple with TestFlight. https: //developer.apple.com/testflight/ (Accessed on 06/10/2025)
2025
-
[16]
Apple Inc. 2025. Develop and distribute an enterprise app. https: //help.apple.com/xcode/mac/current/ (Accessed on 06/10/2025)
2025
-
[17]
Apple Inc. 2025. Device registration updates. https: //developer.apple.com/help/account/reference/device-registration- updates/ (Accessed on 07/21/2025)
2025
-
[18]
Apple Inc. 2025. Devices overview. https://developer .apple.com/help/ account/devices/devices-overview/ (Accessed on 06/10/2025)
2025
-
[19]
Apple Inc. 2025. Distribute proprietary in-house apps to Apple devices. https://support .apple.com/guide/deployment/ distribute-proprietary-in-house-apps-depce7cefc4d/web (Accessed on 07/25/2025)
2025
-
[20]
Apple Inc. 2025. Distributing your app for beta testing and releases. https://developer .apple.com/documentation/xcode/ distributing-your-app-for-beta-testing-and-releases (Accessed on 06/10/2025)
2025
-
[21]
Apple Inc. 2025. Distributing your app to registered devices. https://developer.apple.com/documentation/xcode/distributing- your-app-to-registered-devices (Accessed on 06/10/2025)
2025
-
[22]
Apple Inc. 2025. How to create a new Apple Account. https: //support.apple.com/en-us/108647?device-type =mac (Accessed on 06/10/2025)
2025
-
[23]
Apple Inc. 2025. Installing apps through alternative app distribution in the European Union. https://support .apple.com/en-us/117767 (Accessed on 06/10/2025)
2025
-
[24]
Apple Inc. 2025. iTunes API. https://performance-partners.apple.com/ search-api (Accessed on 08/04/2025)
2025
-
[25]
Apple Inc. 2025. Legal - Apple Media Services - Apple. https: //www.apple.com/legal/internet-services/itunes/us/terms.html (Ac- cessed on 06/10/2025)
2025
-
[26]
Apple Inc. 2025. Program enrollment. https://developer .apple.com/ help/account/membership/program-enrollment/ (Accessed on 06/10/2025)
2025
-
[27]
Taher Roshandel Arbatani, Esmaeil Norouzi, Afshin Omidi, and José María Valero-Pastor. 2021. Competitive strategies of mobile ap- plications in online taxi services.International Journal of Emerging Markets16, 1 (2021). doi:10.1108/IJOEM-01-2019-0029
-
[28]
Simorgh Aryan, Homa Aryan, and J Alex Halderman. 2013. Internet censorship in Iran: A first look. InUSENIX Workshop on Free and Open Communications on the Internet (FOCI)
2013
-
[29]
Azade Asadi Damavandi and Louisa Ha. 2024. e–WOM and app stores in Iran: how online reviews influence purchase intention of paid mobile apps.Journal of Islamic Marketing15, 12 (2024). doi:10 .1108/JIMA- 02-2024-0069
2024
-
[30]
BBC. 2025. Apple and Meta attack ’unfair’€700m EU fines. https://www.bbc.com/news/articles/cm248vzg9jwo (Accessed on 06/10/2025)
2025
-
[31]
BBC. 2025. Flappy Bird creator removes game from app stores. https:// www.bbc.com/news/technology-26114364 (Accessed on 08/06/2025)
2025
-
[32]
Cafebazaar. 2025. Cafebazaar. https://cafebazaar.ir/?l=en (Accessed on 07/12/2025)
2025
-
[33]
Cloudflare. 2026. What we know about Iran’s Internet shutdown. https://blog.cloudflare.com/iran-protests-internet-shutdown/ (Ac- cessed on 04/02/2026)
2026
-
[34]
CNN. 2026. The future of Iran’s internet connectivity is still bleak, even as weeks-long blackout begins to lift. https://www .cnn.com/2026/01/ 30/middleeast/iran-internet-blackout-censorship-intl (Accessed on 04/02/2026)
2026
-
[35]
Corellium. 2025. Intro to iOS mobile reverse engineering. https:// www.corellium.com/blog/ios-mobile-reverse-engineering (Accessed on 09/23/2025)
2025
-
[36]
2015.Estimating Displacement Rates of Copyrighted Content in the EU
Ecorys. 2015.Estimating Displacement Rates of Copyrighted Content in the EU. Technical Report. European Commission
2015
-
[37]
NetBlocks Editorial. 2019. Internet being restored in Iran after week- long shutdown. https://netblocks .org/reports/internet-restored-in- iran-after-protest-shutdown-dAmqddA9 [Online; accessed 2025-07- 22]
2019
-
[38]
Manuel Egele, Christopher Kruegel, Engin Kirda, and Giovanni Vi- gna. 2025. Pios: Detecting privacy leaks in ios applications. InNDSS, Vol. 2011
2025
-
[39]
Dejan Eric, Radovan Bačík, and Igor Fedorko. 2014. Rating decision analysis based on iOS app store data.Quality Innovation Prosperity18 14 Taking a Bite Out of the Forbidden Fruit: Characterizing Third-Party Iranian iOS App Stores (2014). doi:10.12776/qip.v18i2.337
-
[40]
Lida Fadaizadeh, Mohammad Sanaat, Ebrahim Yousefi, and Niloofar Alizadeh. 2022. Mobile Health: A Comparative Study of Medical and Health Applications in Iran.Biomedical and Biotechnology Research Journal (BBRJ)6, 2 (2022). doi:10.4103/bbrj.bbrj_31_22
-
[41]
Farshid Farokhizadeh, Azim Zarei, AbbasAli Rastgar, and Seyed Abbas Ebrahimi. 2023. Dynamics of the Digital Banking Ecosystem in Iran. Journal of Industrial Engineering International19, 4 (2023)
2023
-
[42]
Johannes Feichtner, David Missmann, and Raphael Spreitzer. 2018. Automated Binary Analysis on iOS: A Case Study on Cryptographic Misuse in iOS Applications. doi:10.1145/3212480.3212487
-
[43]
France24. 2026. Partial return of Internet in Iran reveals wider scale of killing. https://www.france24.com/en/partial-return-of-internet- in-iran-reveals-wider-scale-of-killing (Accessed on 26/04/2026)
2026
-
[44]
GitHub. 2025. actions-iTunes-Header. https://github .com/NyaMisty/ actions-iTunes-header (Accessed on 08/04/2025)
2025
-
[45]
GitHub. 2025. ideviceinstaller. https://github .com/libimobiledevice/ ideviceinstaller (Accessed on 08/04/2025)
2025
-
[46]
GitHub. 2025. mldecrypt. https://github .com/hackcatml/mldecrypt (Accessed on 08/04/2025)
2025
-
[47]
Craig N Goodwin and Sandra Woolley. 2022. Sideloading: An Explo- ration of Drivers and Motivations. In35th International BCS Human- Computer Interaction Conference. BCS Learning & Development
2022
-
[48]
Najmeh Hafezieh, Peyman Akhavan, and Farjam Eshraghian. 2011. Exploration of process and competitive factors of entrepreneurship in digital space.Education, Business and Society: Contemporary Middle Eastern Issues4, 4 (2011). doi:10.1108/17537981111190051
-
[49]
Alireza Hashemzadegan and Ali Gholami. 2022. Internet Censorship in Iran: An Inside Look.Journal of Cyberspace Studies6, 2 (2022). doi:10.22059/jcss.2022.349715.1080 2588-5499
-
[50]
iDownloadBlog. 2025. In latest revocation wave, a trigger-happy Apple reportedly revokes even innocent Developer accounts. https://www.idownloadblog.com/2025/08/26/in-latest-revocation- wave-a-trigger-happy-apple-reportedly-revokes-even-innocent- developer-accounts/ (Accessed on 10/07/2025)
2025
-
[51]
Internet Society. 2025. Censorship and Sanctions Impacting Iran’s In- ternet, Report. https://pulse .internetsociety.org/blog/censorship-and- sanctions-impacting-irans-internet-report/ Accessed on 07/13/2025
2025
- [52]
- [53]
- [54]
- [55]
-
[56]
NBC News. 2025. Iran plunged into an internet near-blackout during deepening conflict. https://www .nbcnews.com/tech/internet/iran- plunged-internet-blackout-deepening-conflict-rcna213544 Accessed on 07/13/2025
2025
-
[57]
Y. Y. Ng, H. Zhou, Z. Ji, H. Luo, and Y. Dong. 2025. Which Android App Store Can Be Trusted in China?. In2014 IEEE 38th Annual Computer Software and Applications Conference. doi:10 .1109/COMPSAC.2014.95
2025
-
[58]
Online. 2026. Best Iranian iOS App Stores. http://bit .ly/48lsYTX (Accessed on 07/03/2026)
2026
- [59]
-
[60]
Martin Peitz and Patrick Waelbroeck. 2004. The Effect of Internet Piracy on Music Sales: Cross-Section Evidence.Review of Economic Research on Copyright Issues1, 2 (2004), 71–79
2004
-
[61]
PocketGamer.biz. 2025. After 17 months in soft launch, Assas- sin’s Creed Identity quietly removed from App Store. https: //www.pocketgamer.biz/assassins-creed-identity-removed-from- app-store/ (Accessed on 08/06/2025)
2025
-
[62]
Quds Online. 2025. 70 percent of the country’s internet traffic is filtered/VPNs doubled traffic consumption. https://qudsonline .ir/ xbGG8/ Accessed on 07/13/2025
2025
-
[63]
Amir Rafi, Carlton Shepherd, and Konstantinos Markantonakis. 2023. A First Look at Digital Rights Management Systems for Secure Mobile Content Delivery. doi:10.48550/arXiv.2308.00437
-
[64]
P. B. Prakash Reddy and R. Nallabolu. 2025. Machine learning based De- scriptive Statistical Analysis on Google Play Store Mobile Applications. In2020 Second International Conference on Inventive Research in Com- puting Applications (ICIRCA). doi:10 .1109/ICIRCA48905.2020.9183271
-
[65]
Reporters Without Borders. 2025. Iran: at least 33 journalists in jail while the world marks. https://rsf .org/en/how-islamic-republic-has- enslaved-iran-s-internet/ Accessed on 07/13/2025
2025
-
[66]
Reuters. 2025. Despite sanctions, Apple gear booms in Iran. https://www.reuters.com/article/2012/07/13/us-apple-iran- idUSBRE86C0AY20120713 Accessed on 07/13/2025
2025
-
[67]
Reuters. 2025. Payments system SWIFT to cut off Iranian banks. https://www .reuters.com/article/world/payments-system- swift-to-cut-off-iranian-banks-idUSBRE82E0VS/ (Accessed on 06/11/2025)
2025
-
[68]
Reuters. 2026. Iran plunged into digital darkness, concealing human rights abuses. https://www .reuters.com/world/middle- east/iran-cut-off-world-supreme-leader-warns-protesters-2026-01- 09/?utm_source=chatgpt.com (Accessed on 04/02/2026)
2026
-
[69]
Rafael Rob and Joel Waldfogel. 2006. Piracy on the High C’s: Music Downloading, Sales Displacement, and Social Welfare in a Sample of College Students.Journal of Law and Economics49, 1 (2006), 29–62
2006
-
[70]
Gian Luca Scoccia, Marco Autili, Giovanni Stilo, and Paola Inver- ardi. 2022. An empirical study of privacy labels on the Apple iOS mobile app store. In2022 IEEE/ACM 9th International Conference on Mobile Software Engineering and Systems (MobileSoft). doi:10 .1145/ 3524613.3527813
-
[71]
Steven Seiden, Andrew M. Webb, and Ibrahim Baggili. 2025. Tapping .IPAs: An automated analysis of iPhone applications using apple silicon macs.Forensic Science International: Digital Investigation52 (2025). doi:10.1016/j.fsidi.2025.301871
-
[72]
Sideloadly. 2025. Sideloadly. https://sideloadly .io/ (Accessed on 07/25/2025)
2025
-
[73]
Michael D. Smith and Rahul Telang. 2012. Assessing the Academic Literature Regarding the Impact of Media Piracy on Sales.SSRN Electronic Journal(2012). doi:10.2139/ssrn.2132153
-
[74]
Tejarat News. 2025. Black market for filter breakers has been launched/80% of Iranians use VPNs. https://tejaratnews .com/?p= 944119/ Accessed on 07/13/2025
2025
-
[75]
The Guardian. 2025. Iran blocks capital’s internet access as Amini protests grow. https://www .theguardian.com/world/2022/sep/22/ iran-blocks-capitals-internet-access-as-amini-protests-grow (Ac- cessed on 07/25/2025)
2025
-
[76]
Top10VPN. 2025. VPN Demand Surges Around the World. https: //www.top10vpn.com/research/vpn-demand-statistics/ Accessed on 07/13/2025. 15 Amirhossein Khanlari and Amir Rahmati
2025
-
[77]
UNHCR. 2025. Freedom on the Net 2018 - Iran. https:// www.refworld.org/reference/annualreport/freehou/2018/en/122294 Accessed on 07/13/2025
2025
-
[78]
2010.Intellectual Property: Observations on Efforts to Quantify the Economic Effects of Counterfeit and Pirated Goods
United States Government Accountability Office. 2010.Intellectual Property: Observations on Efforts to Quantify the Economic Effects of Counterfeit and Pirated Goods. Technical Report GAO-10-423. GAO
2010
-
[79]
United States Institute of Peace. 2025. Timeline of U.S. Sanctions. https://iranprimer.usip.org/resource/timeline-us-sanctions (Accessed on 07/25/2025)
2025
-
[80]
Congress
U.S. Congress. 2025. U.S. Sanctions on Iran. https:// www.congress.gov/crs-product/IF12452 (Accessed on 06/11/2025)
2025
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.