The FireEye blog announced an iOS proof of concept that was able to run in the background and record a user’s actions:
We have created a proof-of-concept “monitoring” app on non-jailbroken iOS 7.0.x devices. This “monitoring” app can record all the user touch/press events in the background, including, touches on the screen, home button press, volume button press and TouchID press, and then this app can send all user events to any remote server, as shown in Fig.1. Potential attackers can use such information to reconstruct every character the victim inputs.
Note that the demo exploits the latest 7.0.4 version of iOS system on a non-jailbroken iPhone 5s device successfully. We have verified that the same vulnerability also exists in iOS versions 7.0.5, 7.0.6 and 6.1.x. Based on the findings, potential attackers can either use phishing to mislead the victim to install a malicious/vulnerable app or exploit another remote vulnerability of some app, and then conduct background monitoring.
They are working with Apple, so I’d expect this to get patched reasonably quickly. Good to solve these things, though I don’t see much practical danger if you avoid obvious phishing attempts and only install apps from the App Store. [Via MacRumors]
They said they were able to get their app approved for the App Store, so it sounds like any app you install on your phone could be monitoring you. If what they say is tyre, it sounds scary to me (although I guess the same vulnerability exists on Macs / PCs etc)
If they are able to get this into the Appstore, it is a major problem.
Just imagine if this code were embedded in Flappy Birds or one of the million clones (I guess a Flappy Beards would get downloaded by Jim^^).
This needs to get fixed asap!
Actually the blog says nothing about getting the app into the store. For all we know they simply complied it on their computer and ran it in the simulator or side loaded it.
If it exists at all. They say nothing about what code caused this flaw. One would think they would know that bit and show it as further proof.
As for the ‘working with Apple’ and ‘no reply’ stuff. We have only their word about any of that. Maybe they are and maybe they are just looking for press and trumped up a big threat. Who knows really
You are correct … that particular article did not mention anything. However, the ArsTechnica article about the same exploit has this quote from the researchers: “FireEye successfully delivered a proof-of-concept monitoring app through the App Store that records user activity and sends it to a remote server. We have been collaborating with Apple on this issue.” I’m not sure if it really happened or not, but the researchers did seem to imply that they were able to get an app with background monitoring approved.