Uber app can silently record iPhone screens, security researcher finds

[Allycat]

http://www.dailytelegraph.com.au/technology/uber-app-can-silently-record-iphone-screens-security-researcher-finds/news-story/03b82b166173735d9491ef67f9fd7c05

 

This is very concerning for all users, and why do they need for connecting to an Apple Watch. Scary stuff Apple. I wouldn't want any app to be able to data dump the contents of my screen and that's what it seems to be able to do. I don't want UBER to know everything that I do on a phone they only need to know where you are, where you want to go or in the case of a driver where to pick up someone. It shouldn't have access to phone lists call times messages facebook and every other app on your phone but it seems they have that now.

Quote

An Uber spokesman said that the code had been implemented to improve rendering on its Apple Watch app.

“It’s not connected to anything else in our current codebase and the diff [sic] to remove it is already being pushed into production,” the spokesman said.

“This API would allow maps to render on your phone in the background and then be sent to your Apple Watch.”

 

 

 

Quote

 

What makes this case unique is Uber is the only third-party app to be given private access to the feature by Apple — a conclusion Mr Strafach made after indexing thousands of app binaries.

Apple expert and jailbreak author Luca Todesco said apps can generally only write to the iPhone’s framebuffer — part of the phone’s memory that contains pixel and display data. However, he said this permission means Uber has been given the ability to read or write.

 

 

Quote

Mr Todesco said it was the equivalent of giving Uber the ability of keylogging — the use of a computer program to record every keystroke made by a user, especially in order to gain fraudulent access to passwords and other confidential information.

“I find this very frightening and dangerous,” he said.

The Apple expert added the feature also “paints a pretty big target on top of the app” for hackers looking exploit the permission.

1

 

[DrMacintosh]

8 minutes ago, Allycat said:

and why do they need for connecting to an Apple Watch.

 

8 minutes ago, Allycat said:

This API would allow maps to render on your phone in the background and then be sent to your Apple Watch.”

That's why. 

 

I don't use Uber and never will but that is a valid reason to do something like this. loading times on the Apple Watch (and all smartwatches) is kinda slow. It sounds like the idea here is that your phone could render what the Watch would normally to speed things up. If that is really what it is for idk. 

 

And like what are they going to track where you go? I'm pretty sure they already do that. 

[PlayStation 2]

Considering that it’s not that they exploited something moreso Apple allowed them to do some trickery means to me that this is more of something to note rather than a genuine danger. 

[OmJo93]

Uber doing something shady? Wow, you don't say?

 

Ridiculous how people still support this piece of trash company. 

[Ezio Auditore]

10 hours ago, Nicholatian said:

Absolute pile of horseshit.

 

Any remotely professional software engineer you can find bloody well knows that all code in a codebase is going to be connected if it’s in use. If it isn’t, it would have been optimised out before it was deployed to the public. He’s motioning to remove it after claiming it was totally isolated? Basic logic can show that’s a lame attempt at a coverup.

 

The second quote is just as nonsensical as the first: Rendering and recording are two completely different tasks in code, and some people may tell you they’re orthogonal, even. Maps don’t require “background rendering” because that’s not how rendering works; when you render something, you do so on demand. If it’s not literal graphical rendering and it’s really just analysing/compiling/optimising map data for the Apple Watch, then the recording functionality becomes completely without logic! Rendering tasks are not carried out by recording what’s already rendered to the viewport, because it would be terribly inefficient and therefore asinine in that way.

 

It’s really anyone’s guess why on earth they are really implementing such invasive functionality, not disclosing any of it, and then pissing their pants when people find out about it. That’s the real question at this point: Why?

But steam in-home streaming works the same way and you can play games on it so it mustn't be terribly inefficient.

[79wjd]

5 hours ago, OmJo93 said:

Uber doing something shady? Wow, you don't say?

 

Ridiculous how people still support this piece of trash company. 

Well, given the option between taxis who overcharge, taxi drivers who like to play games, and less availability of competing alternatives (who probably aren't any better, they just get less attention because they're smaller), Uber often becomes the best choice.

[Ezio Auditore]

2 minutes ago, Nicholatian said:

Streaming is another thing that’s pretty much orthogonal to rendering. Give me a break.

I admit that I don't have any experience in software nor do I know how, much of it works so do tell me why I am wrong.

 

You mentioned in the earlier post that it renders on demand which is what is done in steams in-home streaming. You move your character that info is sent to the renderer it computes required data and then again sends it to the steam device to output on the screen. So the apple watch must be doing similar things like sending data to the phone for rendering and showing it on the watch as an image.

[Castdeath97]

I wouldn't trust uber with my trash even, sketchy twats.

[DrMacintosh]

11 hours ago, valdyrgramr said:

If Apple allowed this then yet another reason I don't support Apple too.

How is this inherently a bad thing? Did you not read the first comment posted in reply to this topic? 

[DrMacintosh]

3 minutes ago, valdyrgramr said:

How can you defend it?

I already did. 

 

Assuming the developer is being truthful, Uber is using the iPhone as the device that renders these maps and does the heavy lifting so it can stream that info to your Apple Watch to give a fast and usable experience and that is a perfectly valid. 

 

The Apple Watch is in constant communication with your phone anyway and Uber already tracks where you travel, in what car, and who your driver was. 

 

Don’t see the issue except for the possible security concerns in FUTURE attacks. 

[DrMacintosh]

1 minute ago, valdyrgramr said:

Because they and others have the option to abuse it,

That’s not a very valid reason......

[DrMacintosh]

1 minute ago, valdyrgramr said:

That's a very valid reason to be anti them.

No, a valid reason would be to show how they would abuse it and showing them abusing it. Simply because you could do something is meaningless. 

 

I could do any number of things that would be wrong, would I do them? Probably not and In the US a person or entity is innocent until proven guilty. 

 

Prove Uber guilty if you want to be against them. 

[Misanthrope]

Is Uber just gonna keep on going sinking to a new low every month? How long before headlines read: "Uber sells your location and family details on the deep web to potential kidnappers"?

[DrMacintosh]

2 minutes ago, valdyrgramr said:

Considering Uber's history

I'm not privy to Ubers past conduct so enlighten me. 

 

2 minutes ago, valdyrgramr said:

backed by Apple's history

And what about it? Or are you just going to ignore where Apple went to court with the FBI over unlocking a phone and not moving an inch to defend user privacy unless required by law? 

[DrMacintosh]

Just now, valdyrgramr said:

Read news on their ethics.

You specialize in being vague

 

If you think any company you use is any more "ethical" than Apple is you have another thing coming. I'd like to know who you think is more ethical. 

[DrMacintosh]

4 minutes ago, valdyrgramr said:

Again, I'm not conforming to Apple

What does that even mean? Who is telling you to conform? What are you trying to rebell against? 

 

You aren't making sense. 

[DrMacintosh]

Just now, valdyrgramr said:

I gave my reason why I don't support them,

Your reason was "ethics" 

 

That is what upsets me. You stated a position but are unwilling to back it up. Nothing makes me angrier than people who will not defend their stance. 

[DrMacintosh]

1 minute ago, valdyrgramr said:

Why are you so upset that I don't conform to companies known for being shady?

I'm not, I'm upset that you aren't articulating your reasoning. I've said this already. 

[DrMacintosh]

Just now, valdyrgramr said:

Then if it isn't a debate you can do the research yourself.

If its not a debate its useless statements clumped together to form a sentence without any support or real meaning.   

 

Kinda like rhetoric. 

[DrMacintosh]

1 minute ago, valdyrgramr said:

"If Apple supports this then it is another reason I don't support them."

If the response to that is "k" the it kinda is useless. If affects no one.

 

Now I'm going to go watch the Cosmos so yeah.... 

[DrMacintosh]

1 minute ago, valdyrgramr said:

But, hey if you want more reasons why I don't support Apple I'll give you 2.  One, they've knowingly helped governments spy as have others.  I just mentioned Apple since it is relevant to the topics, others are not.  Two, The Jobs approach hence why Woz left.

Boom those are two perfectly valid reasons! 

 

Was that so hard? Its so much more meaningful and effective than just saying "ethics"

[DrMacintosh]

Just now, valdyrgramr said:

Honestly, I thought you were talking about Uber too.

I am but what you just did is literally all I'm asking for. 

[Ezio Auditore]

6 hours ago, DrMacintosh said:

I already did. 

 

Assuming the developer is being truthful, Uber is using the iPhone as the device that renders these maps and does the heavy lifting so it can stream that info to your Apple Watch to give a fast and usable experience and that is a perfectly valid. 

 

The Apple Watch is in constant communication with your phone anyway and Uber already tracks where you travel, in what car, and who your driver was. 

 

Don’t see the issue except for the possible security concerns in FUTURE attacks. 

But why does it have read access to the frame buffer? I am pretty sure you don't need it for background rendering.

[Guest]

1 hour ago, Ezio Auditore said:

But why does it have read access to the frame buffer? I am pretty sure you don't need it for background rendering.

What I'm concerned with is whether it would be able to "see" what is on your screen say your looking at your banking app while Uber is in the background or something of that nature. I don't know enough about how iOS works in regards to its APIs but I will still state my concern regardless. One reason this could be a concern is if Uber, shady as it usually is, decides to take it a step further or someone else (Random employee or a "hacker") exploits this feature. No operating system has perfect security measures no matter how above the crowd it may be.

[Jito463]

23 hours ago, DrMacintosh said:

In the US a person or entity is innocent until proven guilty. 

That's only in a court of law.  Opinions are not beholden to those standards (and why should they be?).