Suspicious app not installed from the app store or MDM (false detection?)
A recent run of mvt-ios warned that two applications had not been installed from the app store or from MDM:
Suspicious app not installed from the app store or MDMin applications_detected.json, both app descriptors contained identical values of the following keys:
{
"is-auto-download": false,
"launchProhibited": true,
"is-purchased-redownload": false,
"s": 143441,
"isFactoryInstall": false,
"gameCenterEverEnabled": false,
"gameCenterEnabled": false,
"kind": "software",
"hasMessagesExtension": true,
"betaExternalVersionIdentifier": 0,
"variantID": "iPhone9,3",
"sideLoadedDeviceBasedVPP": false,
"DeviceBasedVPP": false,
"sourceApp": "com.apple.datausage.atc",
"subgenres": [],
"rating": {
"label": "4+",
"rank": 100
},
"icon_sha256": "8f447f708ca1c4cca4d6934c4c1fd0eee374b85ae159befe7534c1a869cc415b"
}Both also contained a top-level isodate field from the same day (different times) and a com.apple.iTunesStore.downloadInfo member that contains a dict with a purchaseDate (matching the outer isodate but in UTC) and an accountInfo that appears to contain static information about the user's AppleID.
This seems similar to #348, #383, and #487, but i don't know whether it is something to be concerned about. the date is several years in the past, so i don't have great notes about what else was happening at the time. Can you help me make sense of this alert? does the warning need to be tuned to avoid a false alarm?
Source: mvt-project/mvt