Alleged iOS Security Flaw Enables Malicious Apps to Secretly Log User Touch InputsResearchers from security firm FireEye have
revealed a new bug in iOS that enables a malicious app to monitor and log a user's touch inputs and button uses while running in the background,
reports Ars Technica. The exploit reportedly targets a flaw in iOS' multitasking capabilities to capture user inputs, and allows for them to be sent to a remote server.
To demonstrate the flaw, the researchers created a proof-of-concept monitoring app and developed approaches to "bypass" Apple's App Store Review process effectively. Once the app was installed on an iOS device, actions including keyboard inputs, use of the volume, home, and power buttons, screen touches with exact coordinates, and Touch ID events were all captured. The researchers also noted that disabling iOS 7's "Background App Refresh" setting would not disable a malicious app from logging data, as the only present solution to the problem is to manually remove apps from the task switcher.
FireEye also spoke about the flaw being identified in current versions of iOS:
Note that the demo exploits the latest 7.0.4 version of iOS system on a non-jailbroken iPhone 5s device successfully. We have verified that the same vulnerability also exists in iOS versions 7.0.5, 7.0.6 and 6.1.x. Based on the findings, potential attackers can either use phishing to mislead the victim to install a malicious/vulnerable app or exploit another remote vulnerability of some app, and then conduct background monitoring.
The group added that it is actively working with Apple on the issue, although the company has yet to comment publicly. The news comes less than a week after Apple
issued iOS 7.0.6 in response to a SSL vulnerability that allowed a hacker to capture or modify data from Safari in supposedly secure sessions.
The SSL security bug was also found to be
present in OS X, as
new research over the weekend revealed that additional apps such as FaceTime and iMessage could be compromised. Apple
confirmed to
Reuters that it will issue an OS X software update "very soon" to patch the bug.
Recent Mac and iOS Blog Stories •
'Rogue' Series6XT Graphics for Future iOS Devices Detailed •
Apple Sues Chinese Government Agency and Shanghai Company Over Siri-Related Patents •
WhatsApp to Add Voice Calling in Q2 2014 •
iOS 8 Concept Video Features Unified Interface for Control Center and Multitasking •
Microsoft to Cut Windows Licensing Price by 70% to Compete with Apple •
Fitbit Issues Recall for Fitbit Force Over Skin Irritation Reports •
Apple Planning New Retail Store in Lansing, Michigan •
Adobe Releases Another Emergency Update for Flash <img width='1' height='1' src='
http://rss.feedsportal.com/c/35070/f/648327/s/378113a7/sc/5/mf.gif' border='0'/><br clear='all'/><div class='mf-viral'><table border='0'><tr><td valign='middle'><a href="
http://share.feedsportal.com/share/twitter/?u=http%3A%2F%2Fwww.macrumors.com%2F2014%2F02%2F25%2Fsecurity-flaw-log-touch-inputs%2F&t=Alleged+iOS+Security+Flaw+Enables+Malicious+Apps+to+Secretly+Log+User+Touch+Inputs" target="_blank"><img src="
http://res3.feedsportal.com/social/twitter.png" border="0" />[/url] <a href="
http://share.feedsportal.com/share/facebook/?u=http%3A%2F%2Fwww.macrumors.com%2F2014%2F02%2F25%2Fsecurity-flaw-log-touch-inputs%2F&t=Alleged+iOS+Security+Flaw+Enables+Malicious+Apps+to+Secretly+Log+User+Touch+Inputs" target="_blank"><img src="
http://res3.feedsportal.com/social/facebook.png" border="0" />[/url] <a href="
http://share.feedsportal.com/share/linkedin/?u=http%3A%2F%2Fwww.macrumors.com%2F2014%2F02%2F25%2Fsecurity-flaw-log-touch-inputs%2F&t=Alleged+iOS+Security+Flaw+Enables+Malicious+Apps+to+Secretly+Log+User+Touch+Inputs" target="_blank"><img src="
http://res3.feedsportal.com/social/linkedin.png" border="0" />[/url] <a href="
http://share.feedsportal.com/share/gplus/?u=http%3A%2F%2Fwww.macrumors.com%2F2014%2F02%2F25%2Fsecurity-flaw-log-touch-inputs%2F&t=Alleged+iOS+Security+Flaw+Enables+Malicious+Apps+to+Secretly+Log+User+Touch+Inputs" target="_blank"><img src="
http://res3.feedsportal.com/social/googleplus.png" border="0" />[/url] <a href="
http://share.feedsportal.com/share/email/?u=http%3A%2F%2Fwww.macrumors.com%2F2014%2F02%2F25%2Fsecurity-flaw-log-touch-inputs%2F&t=Alleged+iOS+Security+Flaw+Enables+Malicious+Apps+to+Secretly+Log+User+Touch+Inputs" target="_blank"><img src="
http://res3.feedsportal.com/social/email.png" border="0" />[/url]</td><td valign='middle'></td></tr></table></div>
<img src="[url]http://da.feedsportal.com/r/186530933270/u/49/f/648327/c/35070/s/378113a7/sc/5/rc/1/rc.img" border="0"/>[/url]
<img src="[url]http://da.feedsportal.com/r/186530933270/u/49/f/648327/c/35070/s/378113a7/sc/5/rc/2/rc.img" border="0"/>[/url]
<img src="[url]http://da.feedsportal.com/r/186530933270/u/49/f/648327/c/35070/s/378113a7/sc/5/rc/3/rc.img" border="0"/>[/url]
<img src="[url]http://da.feedsportal.com/r/186530933270/u/49/f/648327/c/35070/s/378113a7/a2.img" border="0"/>[/url]<img width="1" height="1" src="
http://pi.feedsportal.com/r/186530933270/u/49/f/648327/c/35070/s/378113a7/a2t.img" border="0"/><div class="feedflare">
<img src="[url]http://feeds.feedburner.com/~ff/MacRumors-Front?d=yIl2AUoC8zA" border="0"></img>[/url]
<img src="[url]http://feeds.feedburner.com/~ff/MacRumors-Front?d=6W8y8wAjSf4" border="0"></img>[/url]
<img src="[url]http://feeds.feedburner.com/~ff/MacRumors-Front?d=qj6IDK7rITs" border="0"></img>[/url]
</div><img src="
http://feeds.feedburner.com/~r/MacRumors-Front/~4/qVj210cHMWU" height="1" width="1"/>
Source:
Alleged iOS Security Flaw Enables Malicious Apps to Secretly Log User Touch Inputs
