Vulnerabilities / Threats
07:35 PM
Connect Directly

iPhone Tracking Only Tip Of Security Iceberg

Mobile devices will present ongoing security and privacy challenges, particularly to businesses that permit personal usage of corporate devices.

Slideshow: Apple iPhone 4, A True Teardown
(click for larger image and for full slideshow)
Revelations that the iPhone stores data about where users have been on the device and on the computer used to sync the iPhone turn out to be less revelatory than claimed.

Alex Levinson, a senior engineer at Katana Forensics and the developer of a leading iOS forensics application, says that the purported discovery put forward at the Where 2.0 conference on Wednesday has been known for months. Levinson himself contributed to a book--iOS Forensic Analysis for iPhone, iPad, and iPod touch, published in December, 2010--that details the database used to store location data on the iPhone and in iTunes.

Yet, if the privacy risk presented by the presence of this data on iPhones and in iPhone database backups may be less than the researchers reporting the issue this week have suggested, it's nonetheless prompting concern among regulators and businesspeople.

Senator Al Franken (D-Minn.) has penned a letter to Apple CEO Steve Jobs seeking clarification on how iPhone location data is handled, why the data is not encrypted, and whether Apple's handling of this data is permissible under the terms of its privacy policy. Congressman Ed Markey (D-Mass.) has sent a similar letter to Jobs, asking for an answer by May 12--this despite the fact that Apple already explained its location data policy to Markey in a letter sent last July. And Germany's Federal Ministry of Food, Agriculture, and Consumer Protection has expressed interest in clarifications from Apple, according to Reuters.

Apple has legal cover for its actions under its iPhone 4 software license agreement, which states, "Apple and its partners and licensees may transmit, collect, maintain, process and use your location data, including the real-time geographic location of your iPhone, and location search queries." Nonetheless, the company is likely to be forced to change its ways and/or provide a more specific explanation for keeping location data in unencrypted form on iPhones and iPhone database backups, if only because maintaining this information about minors may be legally risky.

Apple has not responded to requests for comment.

Though queries from regulators sound like political opportunism more than anything else, Apple's data storage scheme deserves a closer look. For companies that issue iPhones or iPads to their employees, or that allow employees to use such devices to conduct business, the issue goes beyond Apple's failure to provide specific notification about how and where its software stores unencrypted location data. The issue is that the iPhone, just like other mobile devices, isn't all that secure.

For example, security firm Zscaler security researcher Michael Sutton on Thursday revealed that JotNot Scanner Pro, an iOS application, stores passwords for other applications unprotected in the iTunes backup database. In a blog post, Sutton explains, "Unfortunately, the authentication credentials stored for Evernote, Google Docs, Apple's iDisk and any WebDav enabled server are stored in plain text. Therefore, anyone that gained access to this backup file, would then have your username/password for these services."

Mobile devices present a unique security challenge, particularly because they are often simultaneously consumer and business devices. It's not an insurmountable challenge, however.

Frank Kenney, VP of global strategy for Ipswitch, a maker of secure file transfer software, says that his experience with companies that implement iPhones leads him to believe that access to users' location data is pretty well covered when organizations lock down computers carefully.

1 of 2
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

Published: 2014-10-23
Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.16125), and 2.3 (2.3.9074.18820) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to ct.ashx.

Published: 2014-10-23
Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2) familyName, (3) address1, or (4) address2 parameter to registrationapp/; the (5) comment parameter to all...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.