SpyPhone App Steals Personal Data from ALL iPhones
Share
Saturday, December 05th, 2009 |  #Tags: , ,

Who was that someone shouting loud that only Jailbreaking makes iPhone insecure?  We now have a new App that makes even an UnModified/Virgin iPhone leak personal data like you have never seen before.

A Swiss iPhone developer has unveiled a new application that is capable of harvesting huge amounts of personal data from iPhones, including geolocation data, passwords, address book entries and email accounts information, images, Safari Browsing history, youtube, keyboard logger, etc. all this using just the public API exposed by Apple’s SDK.

In oder for this application, SpyPhone,  to work, it does not need any exploits or any jailbreaking/firmware modification, attacks in order to access the iPhone’s data. Instead, SpyPhone relies on using the iPhone’s usability and depth of features to its advantage. Once an application is on an iPhone, it has unrestricted access to the large amount of the data and settings available on the device.

Seriot, the application developer, has posted the source code for SpyPhone online and gave a talk detail document on iPhone Privacy at a security conference, earlier this week.

Seriot said:

Once on the iPhone, the application begins looking at the stored data that’s available in various other programs, such as the email address book and the keyboard cache, which keeps a record of every keystroke the user enters in a non-password field. This data normally is used for the iPhone’s autocomplete feature, but can be a gold mine of information for an attacker searching for intelligence on the iPhone’s owner. By default, the iPhone will tag any photos taken with the device with the date and location of the pitcure. The user can turn this feature off, but if it’s enabled, SpyPhone can access that data, as well as the log of which WiFi hotspots the device has connected to. All of this gives the attacker a better picture of the iPhone’s owner, his location and his interests, which is valuable data.


The Worst Part: SpyPhone is more like a Trojan sitting in your OS silently and stealing data. All of the SpyPhone’s operations are executed in the background, without the knowledge of the iPhone’s owner, and just like any other Trojan, the application can be set to email reports on each infected phone back to the attacker.

Seriot mentions in his presentation:

Spywares are on the AppStore

And when this kind of app makes it to App store, it becomes a serious issue. And who knows if “one of those spyware apps” already has SpyPhone-alike features.

No doubt, Apple has taken utmost efforts to keep strict control over what applications (their rejections are the proof), but despite their effort, exposing a lot of core of the Operating system has leaded them to misery.

What do you think?

Subscribe to Taranfx Share this post
Subscribe to Taranfx RSS Feed
Share

Related Stories

Category: Security, iPhone News, Jailbreak, Unlock Guides, Hacks
#Tags: , , | Author: Tarandeep Singh
  • ...spyware are everywhere...
  • click down
    ........
  • click down
    ..........
  • I strongly believe that when this kind of anti-spyware applications make it to the mobile application stores then it really becomes a serious issue because who knows if “one of those spyware applications” already has SpyPhone-alike features!
  • Jason
    Filtering out crap like this is what the approval process is for on the App Store. Its never going to be 100% but its better than unrestricted access.

    Yet another sensational article title with little real content.

    Move along there, nothing to see here.
  • r4i
    I think this is a real issue because several malware have already been accepted, before beeing pulled out when eventually discovered.
  • Whatszap
    This is basically what WhatsApp does, what's new? Your phone number is stolen right away after launching that app.
  • I was an iPhone user and I worried about that but until now my gadget still save from this. . .
    Anyway thank you so much for this information. . .
    Maybe I will not use it on my iPhone. . .
  • qsdf
    how do you get it?
  • Allan
    What all you naysayers are missing is that the functionality of this app can be embedded in any other app, and I'm not sure Apple's vetting process will be able to detect these kinds of hidden payloads, especially if they use public APIs. I'm not too worried about apps from indie developers, but would you now trust apps from Google, Coca-Cola, or American Express?
  • yagoa
    an app like this will be very easy to detect because it does all this for no reason.
    things like accessing the photos and adres book are of course highlighted in the approval process.
  • Jeremy
    But... SpyPhone isn't in the app store. So you can't get it without... jailbreaking your iphone!
  • Online Demo anywhere?
  • mike
    *lead them
  • i think its indeed an issue which needs to be addressed otherwise anyone just by installing an application to our mobile would be intruding our personal lives!
  • rohan sharma
    No wonder what Apple thinks about it, I believe, this sucks. Their hunger for revenue from app store will make our life miserable
  • Riders of Rohan
    If you don't use it, how does it make "our life miserable". Take some personal responsibility instead of just whining about it.
  • Joe Groot
    The issue isn't that you'll install *this* application and it can grab all the data on your phone, it's that *any* application could do the same thing. duh!
  • Yeah, gonna file this under "not an issue." For a non-jailbroken iPhone you can't install it without the iPhone SDK or someone who adds your UDID you their provisioning profile. Apple wouldn't allow this to get into the App Store even if it were embedded within another app. So while the "Windows XP-level weak security" jab is a nice try, it doesn't really apply.
  • l4ndy
    Yep, and I'll rate your response the same as all the Microsoft's responses to any vulnerabilities discovered previously, Denial!

    This is clearly an embarrasment for Apple if confirmed. Based on the presented facts, The app is only using APIs available to the public from apple's SDK. As such anyone could create an apparently legit app (Good anough to make it to the Appstore) but in the background run the forementioned code with maybe enhanced reporting function.
    Isn't this what windows trojans do?!?
    He clearly states that no other third party APIs are used.

    Will be interesting to see how this story evolves as it may shed a different light into how security is percieved on different platforms not just a Windows issue.
  • billy_the_kid
    I think this is a real issue because several malware have already been accepted, before beeing pulled out when eventually discovered.

    Moreover, you don't want a phone which imagine a jaleous husband / evil boss / police they could borrow for 5 minutes, install SpyPhone, collect the data, delete SpyPhone and put back in place.
  • As Greg said above probably you should go through the pdf.
    Seriot clearly says
    >> Spywares are on the AppStore
    And when this kind of app makes it to App store(like existing ones), it becomes a serious issue.
    And who knows if "one of those spyware apps" already has spyphone too.
  • JB
    So it has to be installed by the user for it to work. Not much of a spy app is it?
  • Greg
    Seriot talks about that in his PDF.
blog comments powered by Disqus
«
»
Taranfx Home
Hardware
Guides, How Tos
Programming
iPhone
Gadgets
High Definition
Networking
Taranfx Home
Hardware
Guides, How Tos
Programming
iPhone
Gadgets
High Definition
Networking