Warning over iPhone apps that can silently turn on cameras at any time
Warning over iPhone apps that can silently turn on
cameras at any time
The new iPhone X will feature an advanced front camera
that can build up 3D pictures of faces
By James Titcomb 26 OCTOBER 2017 • 11:25AM
Apple has been urged to change the way in which iPhone
apps are granted access to the phone's camera after a security researcher
demonstrated how apps can secretly record photos and videos without the user
knowing.
Felix Krause, an Austrian developer who works for Google,
built an app that was able to take pictures of its user every second and upload
them, without notifying the user. He called it a "privacy loophole that
can be abused by iOS apps".
When an app wants to access the camera, for example to scan
a credit card or take a profile picture during the set-up process, the iPhone
user must give the app permission, in the same way that apps must ask to access
the camera roll, location and contacts and to send notifications. Once allowed,
it has to be turned off via the settings menu.
The system is similar to the permissions required by apps
on Android. Google has recently deleted several apps that surreptitiously
recorded users and masqueraded as legitimate apps.
But Krause said that once an app has been granted initial
access, it can take photos and videos whenever it is opened up. Unlike on Mac
computers, which have a small green light next to the camera when it is being
used, there is no indication that an app is recording videos or taking photos,
or when it sends them elsewhere.
The iPhone's camera app permissions do not differentiate
between the phone's front and back camera. Allowing camera permissions can
grant extra access in the latest version of iOS, which has a facial recognition
engine that could allow apps to detect emotions.
The permissions system is not a bug or a flaw - it works
in exactly the way Apple has designed it - but Krause said malicious apps could
take advantage of it to surreptitiously record users.
He demonstrated this by building an app that took a photo
of the person using it every second, and which also ran a facial recognition
program to detect the person using it.
He warned that other apps could monitor users' emotions
as they scroll through a social network news feed, record what they are saying,
or live stream video of them in the bathroom as they tap away at a smartphone
game.
Krause said Apple should introduce a system of temporary
permissions - one that allows apps to take a picture during the set-up process,
but revokes it after a period of time - or to introduce a warning light or
notification to the iPhone that tells people when they are being recorded.
While there are few examples of apps being found to
secretly record users - apart from those specifically designed for this such as
Stealth Cam - Krause said it would be easy to hide the behaviour, allowing it
to make it through Apple's approval process.
Facebook users have often claimed that the social network
is secretly listening to their conversations in an attempt to better target
adverts, something that Facebook itself has denied.
Some privacy conscious users have taken to covering up
the cameras on their computers in an attempt to prevent being spied on,
including Facebook's founder Mark Zuckerberg.
Krause recently demonstrated how malicious apps could
steal a user's iCloud password by appearing to be an official command. The
developer works at Google but says his work on security is a hobby, in no way
affiliated with his employer.
Apple did not comment.
Comments
Post a Comment