SpyPhone App Steals Personal Data from ALL iPhones

Who was that someone shouting loud that only Jailbreaking makes iPhone insecure?  We now have a new App that makes even an UnModified/Virgin iPhone leak personal data like you have never seen before.

A Swiss iPhone developer has unveiled a new application that is capable of harvesting huge amounts of personal data from iPhones, including geolocation data, passwords, address book entries and email accounts information, images, Safari Browsing history, youtube, keyboard logger, etc. all this using just the public API exposed by Apple’s SDK.

In oder for this application, SpyPhone,  to work, it does not need any exploits or any jailbreaking/firmware modification, attacks in order to access the iPhone’s data. Instead, SpyPhone relies on using the iPhone’s usability and depth of features to its advantage. Once an application is on an iPhone, it has unrestricted access to the large amount of the data and settings available on the device.

Seriot, the application developer, has posted the source code for SpyPhone online and gave a talk detail document on iPhone Privacy at a security conference, earlier this week.

Seriot said:

Once on the iPhone, the application begins looking at the stored data that’s available in various other programs, such as the email address book and the keyboard cache, which keeps a record of every keystroke the user enters in a non-password field. This data normally is used for the iPhone’s autocomplete feature, but can be a gold mine of information for an attacker searching for intelligence on the iPhone’s owner. By default, the iPhone will tag any photos taken with the device with the date and location of the pitcure. The user can turn this feature off, but if it’s enabled, SpyPhone can access that data, as well as the log of which WiFi hotspots the device has connected to. All of this gives the attacker a better picture of the iPhone’s owner, his location and his interests, which is valuable data.


The Worst Part: SpyPhone is more like a Trojan sitting in your OS silently and stealing data. All of the SpyPhone’s operations are executed in the background, without the knowledge of the iPhone’s owner, and just like any other Trojan, the application can be set to email reports on each infected phone back to the attacker.

Seriot mentions in his presentation:

Spywares are on the AppStore

And when this kind of app makes it to App store, it becomes a serious issue. And who knows if “one of those spyware apps” already has SpyPhone-alike features.

No doubt, Apple has taken utmost efforts to keep strict control over what applications (their rejections are the proof), but despite their effort, exposing a lot of core of the Operating system has leaded them to misery.

What do you think?

GD Star Rating
loading...
GD Star Rating
loading...
SpyPhone App Steals Personal Data from ALL iPhones, 10.0 out of 10 based on 1 rating

32 thoughts on “SpyPhone App Steals Personal Data from ALL iPhones”

  1. Yeah, gonna file this under “not an issue.” For a non-jailbroken iPhone you can't install it without the iPhone SDK or someone who adds your UDID you their provisioning profile. Apple wouldn't allow this to get into the App Store even if it were embedded within another app. So while the “Windows XP-level weak security” jab is a nice try, it doesn't really apply.

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply
    • As Greg said above probably you should go through the pdf.
      Seriot clearly says
      >> Spywares are on the AppStore
      And when this kind of app makes it to App store(like existing ones), it becomes a serious issue.
      And who knows if “one of those spyware apps” already has spyphone too.

      GD Star Rating
      loading...
      GD Star Rating
      loading...
      Reply
    • I think this is a real issue because several malware have already been accepted, before beeing pulled out when eventually discovered.

      Moreover, you don't want a phone which imagine a jaleous husband / evil boss / police they could borrow for 5 minutes, install SpyPhone, collect the data, delete SpyPhone and put back in place.

      GD Star Rating
      loading...
      GD Star Rating
      loading...
      Reply
    • Yep, and I'll rate your response the same as all the Microsoft's responses to any vulnerabilities discovered previously, Denial!

      This is clearly an embarrasment for Apple if confirmed. Based on the presented facts, The app is only using APIs available to the public from apple's SDK. As such anyone could create an apparently legit app (Good anough to make it to the Appstore) but in the background run the forementioned code with maybe enhanced reporting function.
      Isn't this what windows trojans do?!?
      He clearly states that no other third party APIs are used.

      Will be interesting to see how this story evolves as it may shed a different light into how security is percieved on different platforms not just a Windows issue.

      GD Star Rating
      loading...
      GD Star Rating
      loading...
      Reply
  2. No wonder what Apple thinks about it, I believe, this sucks. Their hunger for revenue from app store will make our life miserable

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply
    • If you don't use it, how does it make “our life miserable”. Take some personal responsibility instead of just whining about it.

      GD Star Rating
      loading...
      GD Star Rating
      loading...
      Reply
      • The issue isn't that you'll install *this* application and it can grab all the data on your phone, it's that *any* application could do the same thing. duh!

        GD Star Rating
        loading...
        GD Star Rating
        loading...
        Reply
  3. i think its indeed an issue which needs to be addressed otherwise anyone just by installing an application to our mobile would be intruding our personal lives!

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply
  4. But… SpyPhone isn’t in the app store. So you can’t get it without… jailbreaking your iphone!

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply
  5. What all you naysayers are missing is that the functionality of this app can be embedded in any other app, and I'm not sure Apple's vetting process will be able to detect these kinds of hidden payloads, especially if they use public APIs. I'm not too worried about apps from indie developers, but would you now trust apps from Google, Coca-Cola, or American Express?

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply
    • an app like this will be very easy to detect because it does all this for no reason.
      things like accessing the photos and adres book are of course highlighted in the approval process.

      GD Star Rating
      loading...
      GD Star Rating
      loading...
      Reply
  6. I was an iPhone user and I worried about that but until now my gadget still save from this. . .
    Anyway thank you so much for this information. . .
    Maybe I will not use it on my iPhone. . .

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply
  7. Christmas is approaching, the first here, I wish a happy Christmas

    Welcome to http://www.coolforsale.com shopping, thank you

    Availability: dead stock..not available anywhere
    color: white/black/purple
    specialty:star dunk
    retail: $125plus tax = $132and change
    sneaker in 100% condition
    100% authentic
    1 of the best dunk hi premiums
    significance: star galore

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply
  8. I believe your story is alarmist and misleading, because you can’t get this App from the App store. The only way for you to put this on your phone is to jailbreak it. This is complete validation for Apple’s “heavy-handed” review process. Now, they need to train their review robots on app code and make sure these spybot features don’t make it to prime time.

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply
  9. This is basically what WhatsApp does, what's new? Your phone number is stolen right away after launching that app.

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply
  10. I think this is a real issue because several malware have already been accepted, before beeing pulled out when eventually discovered.

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply
  11. Filtering out crap like this is what the approval process is for on the App Store. Its never going to be 100% but its better than unrestricted access.

    Yet another sensational article title with little real content.

    Move along there, nothing to see here.

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply
  12. this is a dumb and pointless article! this doesn’t even exist. it was probably written by Verizon to scare idiots.

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply
  13. Yep, and I'll rate your response the same as all the Microsoft's responses to any vulnerabilities discovered previously, Denial!

    This is clearly an embarrasment for Apple if confirmed. Based on the presented facts, The app is only using APIs available to the public from apple's SDK. As such anyone could create an apparently legit app (Good anough to make it to the Appstore) but in the background run the forementioned code with maybe enhanced reporting function.
    Isn't this what windows trojans do?!?
    He clearly states that no other third party APIs are used.

    Will be interesting to see how this story evolves as it may shed a different light into how security is percieved on different platforms not just a Windows issue.

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply
  14. The Spyphone application that I found on the github is not containing Safari browsing history as showing here may I know where can I get the exact copy of application shown here in the screen shots please.

    Thanks
    NNR

    GD Star Rating
    loading...
    GD Star Rating
    loading...
    Reply

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.