Alleged iOS Security Flaw Enables Malicious Apps to Secretly Log User Touch Inputs

Researchers from security firm FireEye have revealed a new bug in iOS that enables a malicious app to monitor and log a user's touch inputs and button uses while running in the background, reports Ars Technica. The exploit reportedly targets a flaw in iOS' multitasking capabilities to capture user inputs, and allows for them to be sent to a remote server.
fireeye_logging_ios_flaw2
To demonstrate the flaw, the researchers created a proof-of-concept monitoring app and developed approaches to "bypass" Apple's App Store Review process effectively. Once the app was installed on an iOS device, actions including keyboard inputs, use of the volume, home, and power buttons, screen touches with exact coordinates, and Touch ID events were all captured. The researchers also noted that disabling iOS 7's "Background App Refresh" setting would not disable a malicious app from logging data, as the only present solution to the problem is to manually remove apps from the task switcher.

FireEye also spoke about the flaw being identified in current versions of iOS:

Note that the demo exploits the latest 7.0.4 version of iOS system on a non-jailbroken iPhone 5s device successfully. We have verified that the same vulnerability also exists in iOS versions 7.0.5, 7.0.6 and 6.1.x. Based on the findings, potential attackers can either use phishing to mislead the victim to install a malicious/vulnerable app or exploit another remote vulnerability of some app, and then conduct background monitoring.

The group added that it is actively working with Apple on the issue, although the company has yet to comment publicly. The news comes less than a week after Apple issued iOS 7.0.6 in response to a SSL vulnerability that allowed a hacker to capture or modify data from Safari in supposedly secure sessions.

The SSL security bug was also found to be present in OS X, as new research over the weekend revealed that additional apps such as FaceTime and iMessage could be compromised. Apple confirmed to Reuters that it will issue an OS X software update "very soon" to patch the bug.

Top Rated Comments

(View all)
Avatar
87 months ago
welcome to the new microsoft.
Score: 34 Votes (Like | Disagree)
Avatar
87 months ago

How is this even remotely considered a security issue?

Yes, every touch is logged, but none of the logs carry any semantic information about the touches.

What those guys have just demonstrated is of no use to an actual hacker. It would be like tapping a phone line and then only be able to know how many calls are placed each day.


If you know the exact coordinates you can simply overlay the iOS Keyboard and extract everything the user typed in, including passwords, logins or other personal information. :rolleyes: But yeah, no security issue here. LOL.
Score: 24 Votes (Like | Disagree)
Avatar
87 months ago

The researchers also noted that disabling iOS 7's "Background App Refresh" setting would not disable a malicious app from logging data, as the only present solution to the problem is to manually remove apps from the task switcher.


those people closing all their apps don't look so silly after all :p:D:p
Score: 19 Votes (Like | Disagree)
Avatar
87 months ago

How is this even remotely considered a security issue?

Yes, every touch is logged, but none of the logs carry any semantic information about the touches.

What those guys have just demonstrated is of no use to an actual hacker. It would be like tapping a phone line and then only be able to know how many calls are placed each day.

You sure?
The fact that x and y co-ordinates of each touch or release event is captured, could be used as a key-logger once the boundries of each key on the soft keyboard have been worked out.
Score: 18 Votes (Like | Disagree)
Avatar
87 months ago

S: The group added that they are actively working with Apple to fix the issue, as the company has yet to respond.


Business as usual then......
Score: 15 Votes (Like | Disagree)
Avatar
87 months ago
Wow.. Apple.. Much secure :rolleyes:
Score: 12 Votes (Like | Disagree)

Top Stories

First Impressions From New iPhone 12 and 12 Pro Owners

Thursday October 22, 2020 4:20 pm PDT by
It's already Friday, October 23, in Australia and New Zealand, which means some customers who purchased an iPhone 12 or 12 Pro already have their new devices in hand. We've seen dozens of reviews of the iPhone 12 and iPhone 12 Pro from media sites, but now first impressions from regular Apple customers are available. Image via MacRumors reader Boardiesboi New iPhone 12 and 12 Pro owners are...

New Photos Offer Better Look at iPhone 12 Color Options

Tuesday October 20, 2020 2:34 am PDT by
As we wait for the iPhone 12 review embargo to lift later today, more pictures are circulating of the devices in real-world lighting conditions, providing a better look at the different colors available. Leaker DuanRui has shared images on Twitter of the iPhone 12 in white, black, blue, green, and (PRODUCT)RED. The black and white colors are similar to the iPhone 11 colors, but the other...

Photographer Austin Mann Tests the iPhone 12 Pro's Camera

Wednesday October 21, 2020 4:14 am PDT by
Travel photographer Austin Mann usually performs an in-depth review of new iPhone models to test their camera performance in real-world scenarios. To test Apple's new iPhone 12 Pro, Mann traveled to Glacier National Park, Montana. Mann focused on some of the biggest camera upgrades with the iPhone 12 Pro, including the upgraded Wide lens, Ultra Wide Night mode, and LiDAR autofocus, across a...

iPhone 12 Pro Max Has Smaller 3,687 mAh Battery According to Regulatory Filing

Tuesday October 20, 2020 8:48 pm PDT by
Apple's new iPhone 12 Pro Max is equipped with a 3,687 mAh battery, which is around 7% less capacity than the 3,969 mAh battery in the iPhone 11 Pro Max, according to a regulatory filing published by TENAA, the Chinese equivalent of the FCC. The regulatory filing, spotted by MacRumors, also lists the iPhone 12 Pro Max with 6GB of RAM as seen in benchmark results last week. Apple has filed ...

5G Drains iPhone 12 Battery 20% Faster Than 4G in Benchmark

Wednesday October 21, 2020 3:17 am PDT by
After the first reviews for the iPhone 12 and iPhone 12 Pro emerged yesterday, a new report by Tom's Guide reveals the extent of battery life reductions when using 5G. The report outlines a test wherein the iPhone surfs the web continuously at 150 nits of screen brightness, launching a new site every 30 seconds until the battery drains. Interestingly, the test was run on an iPhone 12 and...

Teardown Video Confirms iPhone 12 and iPhone 12 Pro Use Same 2,815mAh Battery

Thursday October 22, 2020 9:47 am PDT by
With the iPhone 12 launching on Friday and in just a few hours to Australia and New Zealand, hands-on videos, teardowns, reviews, and other iPhone-related content has been coming out. A new teardown video delves into both the iPhone 12 and the 12 Pro, confirming battery life for both models and giving us a closer look at their internals. The video from Io Technology is in Chinese, but ...

French iPhone Boxes Come Packed in an Outer Box With Separate EarPods

Wednesday October 21, 2020 6:52 am PDT by
After the news that France would be the only territory to continue to include EarPods with the iPhone, it seems that Apple is not packing the earbuds within the iPhone's box (via iGeneration). Screenshot from TheiCollection's review video The French iPhone 12 and iPhone 12 Pro does not have a different retail box to accommodate EarPods, meaning that all iPhone boxes are consistent...

Some Defective Apple iPhone 12 Cases Shipping Without Speaker Holes

Wednesday October 21, 2020 12:54 pm PDT by
At least two customers who have purchased iPhone 12 cases have received defective cases that do not have speaker holes, which obscures the sound. Photo by Reddit user zarnold16 There have been two separate threads on Reddit from iPhone 12 customers who purchased a case and received one without speaker holes. One customer was told by an Apple advisor that the case wasn't meant to have...

Watch: New iPad Air Unboxing Videos and First Impressions

Wednesday October 21, 2020 6:00 am PDT by
Apple's embargo has lifted on reviews for the new iPad Air ahead of its launch on Friday. In addition to our more detailed review roundup, we've shared a handful of unboxing videos and first impressions of the device below. The new iPad Air via Karl Conrad The new iPad Air features a larger 10.9-inch edge-to-edge display, a faster A14 Bionic chip, and a USB-C port instead of Lightning. It is...

Apple's AirTags Revealed in Newly Published Patent Applications

Thursday October 22, 2020 9:13 am PDT by
Two patent applications filed by Apple appear to depict the company's widely expected AirTags item trackers (via Patently Apple). The filings, which include a large number of images, are titled "Mounting Base for a Wirelessly Locatable Tag" and "Fastener with a Constrained Retention Ring," and describe a wirelessly locatable tag that can be used to determine the absolute location of an...