Who was that someone shouting loud that only Jailbreaking makes iPhone insecure? We now have a new App that makes even an UnModified/Virgin iPhone leak personal data like you have never seen before.
A Swiss iPhone developer has unveiled a new application that is capable of harvesting huge amounts of personal data from iPhones, including geolocation data, passwords, address book entries and email accounts information, images, Safari Browsing history, youtube, keyboard logger, etc. all this using just the public API exposed by Apple’s SDK.
In oder for this application, SpyPhone, to work, it does not need any exploits or any jailbreaking/firmware modification, attacks in order to access the iPhone’s data. Instead, SpyPhone relies on using the iPhone’s usability and depth of features to its advantage. Once an application is on an iPhone, it has unrestricted access to the large amount of the data and settings available on the device.
Seriot, the application developer, has posted the source code for SpyPhone online and gave a talk detail document on iPhone Privacy at a security conference, earlier this week.
Seriot said:
Once on the iPhone, the application begins looking at the stored data that’s available in various other programs, such as the email address book and the keyboard cache, which keeps a record of every keystroke the user enters in a non-password field. This data normally is used for the iPhone’s autocomplete feature, but can be a gold mine of information for an attacker searching for intelligence on the iPhone’s owner. By default, the iPhone will tag any photos taken with the device with the date and location of the pitcure. The user can turn this feature off, but if it’s enabled, SpyPhone can access that data, as well as the log of which WiFi hotspots the device has connected to. All of this gives the attacker a better picture of the iPhone’s owner, his location and his interests, which is valuable data.
The Worst Part: SpyPhone is more like a Trojan sitting in your OS silently and stealing data. All of the SpyPhone’s operations are executed in the background, without the knowledge of the iPhone’s owner, and just like any other Trojan, the application can be set to email reports on each infected phone back to the attacker.
Seriot mentions in his presentation:
Spywares are on the AppStore
And when this kind of app makes it to App store, it becomes a serious issue. And who knows if “one of those spyware apps” already has SpyPhone-alike features.
No doubt, Apple has taken utmost efforts to keep strict control over what applications (their rejections are the proof), but despite their effort, exposing a lot of core of the Operating system has leaded them to misery.
What do you think?
loading...
loading...
So it has to be installed by the user for it to work. Not much of a spy app is it?
loading...
loading...
Seriot talks about that in his PDF.
loading...
loading...
Yeah, gonna file this under “not an issue.” For a non-jailbroken iPhone you can't install it without the iPhone SDK or someone who adds your UDID you their provisioning profile. Apple wouldn't allow this to get into the App Store even if it were embedded within another app. So while the “Windows XP-level weak security” jab is a nice try, it doesn't really apply.
loading...
loading...
As Greg said above probably you should go through the pdf.
Seriot clearly says
>> Spywares are on the AppStore
And when this kind of app makes it to App store(like existing ones), it becomes a serious issue.
And who knows if “one of those spyware apps” already has spyphone too.
loading...
loading...
I think this is a real issue because several malware have already been accepted, before beeing pulled out when eventually discovered.
Moreover, you don't want a phone which imagine a jaleous husband / evil boss / police they could borrow for 5 minutes, install SpyPhone, collect the data, delete SpyPhone and put back in place.
loading...
loading...
Yep, and I'll rate your response the same as all the Microsoft's responses to any vulnerabilities discovered previously, Denial!
This is clearly an embarrasment for Apple if confirmed. Based on the presented facts, The app is only using APIs available to the public from apple's SDK. As such anyone could create an apparently legit app (Good anough to make it to the Appstore) but in the background run the forementioned code with maybe enhanced reporting function.
Isn't this what windows trojans do?!?
He clearly states that no other third party APIs are used.
Will be interesting to see how this story evolves as it may shed a different light into how security is percieved on different platforms not just a Windows issue.
loading...
loading...
No wonder what Apple thinks about it, I believe, this sucks. Their hunger for revenue from app store will make our life miserable
loading...
loading...
If you don't use it, how does it make “our life miserable”. Take some personal responsibility instead of just whining about it.
loading...
loading...
The issue isn't that you'll install *this* application and it can grab all the data on your phone, it's that *any* application could do the same thing. duh!
loading...
loading...
i think its indeed an issue which needs to be addressed otherwise anyone just by installing an application to our mobile would be intruding our personal lives!
loading...
loading...
*lead them
loading...
loading...
But… SpyPhone isn’t in the app store. So you can’t get it without… jailbreaking your iphone!
loading...
loading...
Online Demo anywhere?
loading...
loading...
What all you naysayers are missing is that the functionality of this app can be embedded in any other app, and I'm not sure Apple's vetting process will be able to detect these kinds of hidden payloads, especially if they use public APIs. I'm not too worried about apps from indie developers, but would you now trust apps from Google, Coca-Cola, or American Express?
loading...
loading...
an app like this will be very easy to detect because it does all this for no reason.
things like accessing the photos and adres book are of course highlighted in the approval process.
loading...
loading...
how do you get it?
loading...
loading...
I was an iPhone user and I worried about that but until now my gadget still save from this. . .
Anyway thank you so much for this information. . .
Maybe I will not use it on my iPhone. . .
loading...
loading...
Christmas is approaching, the first here, I wish a happy Christmas
Welcome to http://www.coolforsale.com shopping, thank you
Availability: dead stock..not available anywhere
color: white/black/purple
specialty:star dunk
retail: $125plus tax = $132and change
sneaker in 100% condition
100% authentic
1 of the best dunk hi premiums
significance: star galore
loading...
loading...
I believe your story is alarmist and misleading, because you can’t get this App from the App store. The only way for you to put this on your phone is to jailbreak it. This is complete validation for Apple’s “heavy-handed” review process. Now, they need to train their review robots on app code and make sure these spybot features don’t make it to prime time.
loading...
loading...
This is possibly the stupidest thing i’ve ever read.
And beleive me, i’ve read a lot of stupid shit.
loading...
loading...
This is basically what WhatsApp does, what's new? Your phone number is stolen right away after launching that app.
loading...
loading...
I think this is a real issue because several malware have already been accepted, before beeing pulled out when eventually discovered.
loading...
loading...
Filtering out crap like this is what the approval process is for on the App Store. Its never going to be 100% but its better than unrestricted access.
Yet another sensational article title with little real content.
Move along there, nothing to see here.
loading...
loading...
this is a dumb and pointless article! this doesn’t even exist. it was probably written by Verizon to scare idiots.
loading...
loading...
Yep, and I'll rate your response the same as all the Microsoft's responses to any vulnerabilities discovered previously, Denial!
This is clearly an embarrasment for Apple if confirmed. Based on the presented facts, The app is only using APIs available to the public from apple's SDK. As such anyone could create an apparently legit app (Good anough to make it to the Appstore) but in the background run the forementioned code with maybe enhanced reporting function.
Isn't this what windows trojans do?!?
He clearly states that no other third party APIs are used.
Will be interesting to see how this story evolves as it may shed a different light into how security is percieved on different platforms not just a Windows issue.
loading...
loading...
……….
loading...
loading...
……..
loading...
loading...
…spyware are everywhere…
loading...
loading...
Spyware is everywhere:(
loading...
loading...
yeah, not only iphone, htc, nokia do this too
loading...
loading...
The Spyphone application that I found on the github is not containing Safari browsing history as showing here may I know where can I get the exact copy of application shown here in the screen shots please.
Thanks
NNR
loading...
loading...
Omg…What software./….I am afraid of this software….
http://www.buy3buy.comNew Online Store,Get Name Brand Fashion From 12USD Now!
loading...
loading...