Highlighting crucial weaknesses in Apple's and Google's processes for admitting new titles into their competing app stores, both companies have ejected a third-party Instagram app after discovering it probably pilfered user passwords and pictures.

InstaAgent, as the app was called, marketed itself as a program that tracked people who visited a user's Instagram account. It had between 100,000 and 500,000 downloads from Google's Play Store and was in the top charts of the iOS App Store. But behind the scenes, an app developer said earlier this week, the app sent users' Instagram login credentials to a server controlled by the InstaAgent developer. Google was the first to pull the app. Apple later followed.

According to a blog post published Thursday by the iOS developer:

This suspicious packet contained the Instagram username and password and was sent to “instagram.zunamedia.com”: Another mentionable fact is that the InstaAgent developer used the subdomain instagram.zunamedia.com to sent the data that was EXACTLY the same data that has been sent to the official Instagram servers to his server. I think that he wanted to “hide” his malicious HTTP packet because at the first glance it looked like an “official” HTTP packet to the Instagram servers (but however this is only a presumption). About 24h after I used the app an image (seld-adversting for InstaAgent) was published (WITHOUT my permission) to my Instagram account.[sic]

In a recent post, the InstaAgent developer said passwords were never stored on unauthorized servers. That's little comfort to people who used the app and unwittingly sent their passwords over the Internet.

The larger issue, of course, is that neither Apple nor Google detected the suspicious behavior on their own when deciding whether to admit the app. And if a rogue app can obtain login credentials for Instagram, it's conceivable other apps can get passwords for much more sensitive services as well. It would be ideal if both Apple and Google said more about their vetting processes so users would have a better idea of how protected they are when downloading apps. In the meantime, security-conscious readers are advised to remain skeptical of the companies' vague assurances and install apps sparingly.