With Camera Permission, iPhone Apps Can Surreptitiously Take Pictures and Videos (vice.com)
An anonymous reader writes: Whenever you give iPhone apps permission to access your camera, the app can surreptitiously take pictures and videos of you as long as the app is in the foreground, a security researcher warned on Wednesday. This is not a bug, but keep it in mind when a random app asks you for permission to access your camera. What this means is that even if you don't see the camera "open" in the form of an on-screen viewfinder, an app can still take photos and videos. It is unknown how many apps currently do this, but Krause created a test app as a proof-of-concept. This behavior is what enables certain "spy" apps like Stealth Cam and Easy Calc - Camera Eye to exist. But even if this behavior is well-known among iOS developers and hardcore users, it's worth remembering that all apps that have camera permission can technically take photos in this way. "It's something most people have no idea about, as they think the camera is only being used if they see the camera content or a LED is blinking," Krause told Motherboard in a chat over Twitter direct message. Krause currently works at Google, but performed and published this research independently of his work there.
Thanksgiving wishes
So the Google employee also probably knows that Android apps can do the exact same thing. And there are spy camera apps for Android too.
Slow news day, apparently.
Nice one here www.myschoolzone.com.ng
I thought everyone knew this.
Oh, it's a vice article. Never mind.
it's not surreptitious.
Give an app permission to use your camera and it can use your camera. Who knew? Also, how slow a news day does it have to be to greenlight something like this?
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Same thing with the microphone. This is news?
A security researcher was needed to know that if you give something camera access that it can use your camera to take pictures and video? Isn’t that the whole point of allowing an app access to the camera? What else did they think the permission granted?
99.99% of people don't give a shit.
I don't respond to AC's.
That's the business model. As Bruce Schneier says it's a "Surveillance Business Model". That's the "deal". They give you a set of crappy applications for free, you ignore the fact that they can and will spy on you the maximum degree they think they can get away with (and beyond if they think they can hide their activities from you). OF COURSE these apps are gonna take your picture without you knowing. If they thought they could hold pictures of you fucking your wife for ransom, they'd do that too. If they can convert your everyday speech to text and log your entire day's conversation to mine with AI for marketing tips or other ways to pull some kind of overseas Bitcoin blackmail, THEY WILL. If you think that last bit came from my tinfoil hat, you must have been asleep when Samsung did it with their smart TVs while they were supposedly turned off. All this spying and dishonestly is really fundamentally part of the new corporate business model. It's not a fluke, or news; it's the new normal.
I don't need those permissions active all the time. Plus there's bugs and hacks.
Twinstiq, game news
Whenever you give iPhone apps permission to access your camera, the app can surreptitiously take pictures and videos of you
Wow, really? Whoever would have guessed?
but performed and published this research
This is hardy research. I certainly hope it isn't the epitome of this secury researcher's career.
systemd is Roko's Basilisk.
The customer had an issue with her laptop as soon as she booted it when she got home from wherever. Well, the tech knew his stuff, and 'programmed' the thing to send video from her laptop camera so he knew to remote access her desktop, but the video was good enough to begin with. Guess he was caught, because it did appear on slashdot.
The "researcher" is Felix Krause, who works for Google. His previous revelation was that apps could create input dialogs that look like password entry screens. He neglected to mention that Android phones have the same "flaws".
Oh man ... I think we should just stop using our smart phones.
"Whenever you give iPhone apps permission to access your camera, the app can surreptitiously take pictures and videos "
I'm flabbergasted, next you'll tell us if I give them permission to use the microphone, they can listen to us.
if that "Destiny 2 super companion app" asks you for permission to use your camera and microphone, tell it to F off, as there should be no reason for it to have access to those.
I don't know about that. Does Destiny 2 expose an API for companion apps that allows syncing a companion app to a player's account by photographing a 2D barcode displayed on the screen?
Perhaps the intent is that "foreground microphone" and "background microphone" ought to be split into separate permissions, as ought "foreground camera" and "background camera".
Thanks iPhone X! :)
I think it's still a really valid question.... Why aren't these phones designed so an indicator light on them has to be lit if the camera is in use by something? Wire that up in the hardware so it's not a light you can bypass via clever software coding.
Even if you don't care a bit about some app trying to sneakily take pictures or video while you have it running in the background, that impacts your battery life so you'd want to know about it just for that reason.
Just because I grant an app permission to use the camera doesn't mean I'm ok with it trying to mis-use the camera input for other purposes than its stated function it performs while in the foreground.
Hardware real-estate is precious. You could use a multi-color notification light, but I already have trouble remembering which color means what.
Instead, just use a notification icon. Android supports screenshotting through 3rd-party apps, but will show an icon whenever a screenshot is being taken. The same could be done for the camera and microphone. Although the microphone may be troublesome in the case of always-on "ok google" detection.
Avantslash: low-bandwidth mobile slashdot.