Uber app can silently record iPhone screens, researcher finds

(Image: file photo)Uber has said it will remove code from its iPhone app that security researchers say could let the ride-sharing app record the screen — even when the app is closed.
Will Strafach, a security researcher, discovered this week that Uber had been granted an undocumented private app permission allowing access to the screen-recording feature. It’s one of many “entitlements” that allow developers to tap into features of an iPhone or iPad that are normally off limits to most app developers, unless they have been granted special permission by Apple.

Many screen-recording apps use this entitlement without permission, such as iRec, which run on jailbroken devices.
Strafach said that to his knowledge, based on thousands of app binaries he has indexed, Uber is the only third-party app that was given a private entitlement.
Other iPhone and iPad app developers said the move was unprecedented.
Apple expert and jailbreak author Luca Todesco told ZDNet that it was an “extremely dangerous use case.”
Todesco explained that the specific entitlement, known as “com.apple.private.allow-explicit-graphics-priority,” allows a developer to read or write to the iPhone’s framebuffer, a part of the phone’s memory that contains pixel and display data. “Writing is always possible from an app using normal rendering services, which draw to framebuffer on your behalf,” he said. “Reading allows you to look at the device’s screen.”
“It’s the equivalent of giving keylogging ability to apps,” he said.
信息系统安全是指利用信息安全技术及管理手段,保护信息在采集、传输、交换、处理和存储等过程中的可用性、保密性、完整性和不可抵赖性,保障信息系统的安全、稳定运行。
He also warned that it adds “a significant weakness” to users of Uber’s app, because gaining code execution rights would let an attacker log user’s credentials. “It paints a pretty big target on top of the app,” he said.
“I find this very frightening and dangerous,” he said.
An Uber spokesperson said that the code was used to improve the rendering on its Apple Watch app.
“It’s not connected to anything else in our current codebase and the diff [sic] to remove it is already being pushed into production,” said a spokesperson. “This API would allow maps to render on your phone in the background and then be sent to your Apple Watch,” they added.
“Subsequent updates to Apple Watch and our app removed this dependency, so we’re removing the API completely,” said the spokesperson.
It’s the latest in a long history of privacy issues and violations centered on Uber and its app.
It’s the latest in a long history of similar Uber-related privacy issues, including programs used to track drivers of competing service Lyft, and other secret programs aimed at discovering and frustrating efforts by law enforcement and undercover authorities.
The New York Times reported earlier this year that Apple chief executive Tim Cook threatened to kick Uber out of the Apple App Store after Uber was caught violating its rules by tracking iPhones after the app was deleted.
Strafach said he didn’t know how, “even after [Uber] previously abused” the rules, Uber still “convinced Apple to let them have exclusive access to this privileged” entitlement.
“It seems they got special treatment and do not want to directly admit it,” he said.
When reached, an Apple spokesperson did not comment.
Contact me securely
网络安全法宣传推广视频 https://v.qq.com/x/page/p050493s0f5.html
Zack Whittaker can be reached securely on Signal and WhatsApp at 646-755–8849, and his PGP fingerprint for email is: 4D0E 92F2 E36A EC51 DAAE 5D97 CB8C 15FA EB6C EEA5.
Read More
ZDNET INVESTIGATIONS
Leaked TSA documents reveal New York airport’s wave of security lapses
US government pushed tech firms to hand over source code
At the US border: Discriminated, detained, searched, interrogated
Millions of Verizon customer records exposed in security lapse
Meet the shadowy tech brokers that deliver your data to the NSA
Inside the global terror watchlist that secretly shadows millions
FCC chairman voted to sell your browsing history — so we asked to see his
With a single wiretap order, US authorities listened in on 3.3 million phone calls
198 million Americans hit by ‘largest ever’ voter records leak
Britain has passed the ‘most extreme surveillance law ever passed in a democracy’
Microsoft says ‘no known ransomware’ runs on Windows 10 S — so we tried to hack it
Leaked document reveals UK plans for wider internet surveillance
无论好人坏人,互联网都是很好的工具,简单说,在互联网上,坏家伙们在浪费、在偷窃、在破坏,而好人们一定要携起手来,走在坏家伙们前面的好人们一定要帮助后进的好人们,还要让坏家伙们改邪归正。

猜您喜欢

中国企业走向世界,需融合全球安全文化,线上教程帮助您:
企业安全歌,唱红中国,唱响全球
网络安全法实施宣传
中国地震台:云南小行星撞击相当于2.1级地震
NCSS CHARLTONTEACHING
自带计算设备BYOD的安全职责探讨