Slashdot Mirror
Uber's iOS App Had Secret Permissions That Allowed It to Copy Your Phone Screen, Researchers Say (gizmodo.com)
To improve functionality between Uber's app and the Apple Watch, Apple allowed Uber to use a powerful tool that could record a user's iPhone screen, even if Uber's app was only running in the background, security researchers told news outlet Gizmodo. From a report: After the researchers discovered the tool, Uber said it is no longer in use and will be removed from the app. The screen recording capability comes from what's called an "entitlement" -- a bit of code that app developers can use for anything from setting up push notifications to interacting with Apple systems like iCloud or Apple Pay. This particular entitlement, however, was intended to improve memory management for the Apple Watch. The entitlement isn't common and would require Apple's explicit permission to use, the researchers explained. Will Strafach, a security researcher and CEO of Sudo Security Group, said he couldn't find any other apps with the entitlement live on the App Store. "It looks like no other third-party developer has been able to get Apple to grant them a private sensitive entitlement of this nature," Strafach said. "Considering Uber's past privacy issues I am very curious how they convinced Apple to allow this."
Apple users tolerate anything. Even things that protest/boycott over, they're willing to actually move up their purchase schedule when Apple responds to their demands by asking for more money.
This is a well-trodden path.
Sorry, but Uber's business model is pretty much end to end "be colossal assholes, claim regulations don't apply, and keep being assholes".
Sorry, but this isn't a company I would ever trust or do business with.
Claiming you're a magical pony who isn't covered by laws doesn't make it true.
Apple tosses apps out of the app store for many reasons. Over the last 2-3 years, Uber's apps have shown to violate privacy and intentionally deceive regulators on a massive scale. Money aside (I know, that's asking a lot), how does Apple justify allowing them to continue to have an app in their app store?
There goes Apple's reputation for security.
I expect that there was money involved.
Apple cares about security, as long as there is no way to make money out of making you insecure.
The only real remedy for this is if Apple pushed out an IOS update that took away the ability for these hidden privileges to exist, but likely they won't because probably the main other user of them is Apple itself.
The real "Libtards" are the Libertarians!
It's sortof impressive how many times Uber apps have been found to contain questionable abilities that Uber claims they stopped using some time ago.
For the sake of argument, let's assume that they are being truthful when they say these things. My response is: get your engineering house in order.
Leaving dead code in your software is a terrible practice for a number of reasons. Don't wait until someone discover it's there before you remove it. Remove it as soon as you stop using it.
It's not as bad as it sounds.
There was no way for the original apple watch to get maps on the phone. Apple allowed Uber to use a system function to take a screen recordings from the phone to send to the watch so it could show maps.
Apple specially vetted the code source and inspected it with every update to make sure it was only taking and sending shots of map from Uber app.
Basically you are already trusting apple for an enormous amount of things, this is just one more thing, you are trusting apple to sufficiently police the rare entitlements.
However I agree it's seedy, and the app should need to request permission to record the screen just like for other access permissions. Apple seem to deliberately have done this on the down low.
It's called money, dumbass.
If Apple vetted the code then how come Uber was able to collect screenshots even when it was not running? It should have informed the user about the permission. I don't blindly trust Apple. I trust Apple that it will make right decisions and in this case, it failed me.
Did no one read the permissions list the app asks for? Its really long... there is no reason for most of it, so why are people now shocked that it was nefarious? It even lists "modify or delete your storage contents" for Jobs sake.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
It did inform users, there are three pages of app permissions. The Uber app has more or less full control over your phone.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
This incident has shaken my faith in Apple. Thankfully, I am not a victim as I don't use Uber.
Not a victim of the announced leak, but what about the unannounced/undiscovered ones?
There's a reason why some of us only use free software on free operating systems, and this kind of abuse is a perfect example of what happens when you trust proprietary software on a closed operating system. If you use a so-called "smart" device, you are a patsy, a mark, a willing victim. Stop hurting yourself.
It didn't take screenshots when not running.
But the app had iOS's permission to do it.
Apple vetted the code to make sure they didn't.
As other's have said, this whole thing seems shady and unpleasant, but it doesn't look like this privilege was abused (though I'd rather they never had it in the first place).
It's turtles all the way down.
The more I learn about Uber, the more obvious it becomes that they're a shit-filled cesspool without a shred of ethics or morality.
I was already pretty down on them, but this firmly cements my resolve to never EVER use them and to bad mouth them at every possible opportunity. Shitbags with a logo, that's all they are.
Just cruising through this digital world at 33 1/3 rpm...
You don't know what you are taking about. iOS does not list permissions. You are thinking of Android.
Screen recording is fully supported and available to any app. Note however that the system will ask you nicely if you want to allow a particular app to start capturing screen and this prompt can not be suppressed by the app. The user has a checkbox to allow the same app to do it silently in future. I don't know if Apple allows such access without user warning.
By using this technique, the app was able to display a map on the watch screen. This allows you to keep your phone in your pocket when youâ(TM)re out in dark, possibly unfamiliar streets at night. There are security implications of that too.
This is an interesting story and itâ(TM)s plausible that Uber would abuse this privilege if they could get away with that. But, if they couldnâ(TM)t, it may just be a story about how capable iOS and the App Stire review team are.
This is why I don't download apps where an existing web interface that will do the job. I object to using Uber tho, so I don't even know whether you can use the service thru a web app. But so many other companies have perfectly serviceable web sites that you can use instead of an app, why let them even further thru the door and into your phone.
Because have permission to and actually doing it are two different things.
True, but from a security point of view, you must assume that if an app has permission to do something, it is doing it.
TFA covers this: apple gave the Uber app special privileges not available to other apps.
And Apple did. But I'm talking about the end user, not the vendor.