[crote]

The trick is to push a modified version only to the few clients you want to attack. Use it sparingly and you won't get caught.

[palata]

Or just hack the phone of those few clients with another attack vector. Doesn't mean that security is entirely useless. It depends on the threat model.

[rvnx]

and most of all, do not forget the logfiles on an open server (it was their mistake, otherwise it would have been fine I think)