New in OS X: Get MacRumors Push Notifications on your Mac

Resubscribe Now Close

Alleged iOS Security Flaw Enables Malicious Apps to Secretly Log User Touch Inputs

Researchers from security firm FireEye have revealed a new bug in iOS that enables a malicious app to monitor and log a user's touch inputs and button uses while running in the background, reports Ars Technica. The exploit reportedly targets a flaw in iOS' multitasking capabilities to capture user inputs, and allows for them to be sent to a remote server.
fireeye_logging_ios_flaw2
To demonstrate the flaw, the researchers created a proof-of-concept monitoring app and developed approaches to "bypass" Apple's App Store Review process effectively. Once the app was installed on an iOS device, actions including keyboard inputs, use of the volume, home, and power buttons, screen touches with exact coordinates, and Touch ID events were all captured. The researchers also noted that disabling iOS 7's "Background App Refresh" setting would not disable a malicious app from logging data, as the only present solution to the problem is to manually remove apps from the task switcher.

FireEye also spoke about the flaw being identified in current versions of iOS:
Note that the demo exploits the latest 7.0.4 version of iOS system on a non-jailbroken iPhone 5s device successfully. We have verified that the same vulnerability also exists in iOS versions 7.0.5, 7.0.6 and 6.1.x. Based on the findings, potential attackers can either use phishing to mislead the victim to install a malicious/vulnerable app or exploit another remote vulnerability of some app, and then conduct background monitoring.
The group added that it is actively working with Apple on the issue, although the company has yet to comment publicly. The news comes less than a week after Apple issued iOS 7.0.6 in response to a SSL vulnerability that allowed a hacker to capture or modify data from Safari in supposedly secure sessions.

The SSL security bug was also found to be present in OS X, as new research over the weekend revealed that additional apps such as FaceTime and iMessage could be compromised. Apple confirmed to Reuters that it will issue an OS X software update "very soon" to patch the bug.

Top Rated Comments

(View all)

9 months ago
welcome to the new microsoft.
Rating: 34 Votes
9 months ago

How is this even remotely considered a security issue?

Yes, every touch is logged, but none of the logs carry any semantic information about the touches.

What those guys have just demonstrated is of no use to an actual hacker. It would be like tapping a phone line and then only be able to know how many calls are placed each day.


If you know the exact coordinates you can simply overlay the iOS Keyboard and extract everything the user typed in, including passwords, logins or other personal information. :rolleyes: But yeah, no security issue here. LOL.
Rating: 24 Votes
9 months ago

The researchers also noted that disabling iOS 7's "Background App Refresh" setting would not disable a malicious app from logging data, as the only present solution to the problem is to manually remove apps from the task switcher.


those people closing all their apps don't look so silly after all :p:D:p
Rating: 19 Votes
9 months ago

How is this even remotely considered a security issue?

Yes, every touch is logged, but none of the logs carry any semantic information about the touches.

What those guys have just demonstrated is of no use to an actual hacker. It would be like tapping a phone line and then only be able to know how many calls are placed each day.


You sure?
The fact that x and y co-ordinates of each touch or release event is captured, could be used as a key-logger once the boundries of each key on the soft keyboard have been worked out.
Rating: 18 Votes
9 months ago

S: The group added that they are actively working with Apple to fix the issue, as the company has yet to respond.


Business as usual then......
Rating: 15 Votes
9 months ago
Wow.. Apple.. Much secure :rolleyes:
Rating: 12 Votes
9 months ago
The NSA can do the same (and more) via special software on the SIM or flash memory. They call it DROPOUTJEEP and GOPHERSET.



Rating: 11 Votes
9 months ago
Yet another NSA techie is going to slam his head into the wall while saying "****! They found yet another loophole that I inserted!"
Rating: 10 Votes
9 months ago
This better not be lurking away in GBA4iOS!!!
Rating: 8 Votes
9 months ago
I thought the Iphone didn't have multitasking... I heard it so many times in here.
Rating: 8 Votes

[ Read All Comments ]