Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

How iOS App Permissions Open Holes for Hackers

The permissions iOS apps request from users can turn the devices into spy tools and provide a toehold into the enterprise network, according to new research.

In many ways, the era of the smartphone is defined by apps, which do everything from sending messages to tracking our exercise. New research shows how Apple iOS apps come with substantial costs to privacy and security via the data-gathering permissions users grant them.

The new research, conducted by Wandera, reviewed permissions requested by 30,000 iOS apps most commonly seen on their network of corporate devices, most of which were free apps. Wandera found there are permissions to three sources of data requested by more than half the apps: Location when the app is in use (51%); camera (55%); and the user's photo library (62%).

Not suprisingly, social networking apps request permission for the most data, with an average of 4.96 data sources. The second "grabbiest" category though, is weather apps, asking for access to 4.73 data sources.

Why do the apps need so much user data? "[App publishers are] trying to build profiles on individual users that could yield more value to them as a development team or as a firm that made an investment in that application," says Wandera vice president Michael Covington.

Some 95% of the apps studied by Wandera were free apps. "There's not a ton of money in the applications themselves," Covington says. And it's notable that, according to the research, paid apps tend to request no device permissions far more often (more than 25% of the time) than free apps (15%). 

While users explicitly grant permission for the apps to gather this data, Covington says that there can be a dramatic difference between the access required to initially set up the app and the access required for the ongoing functioning of the app.

"Many of these apps ask for permissions that ultimately should be used once," he says. "If you think about adding a new credit card to Apple Pay, you take a picture of the credit card and you really don't use the camera again."

Those ongoing permissions represent a security risk for more than just the consumer, according to Mike Fong, CEO and founder of Privoro. For enterprises and government agencies, giving apps access to smartphone sensors is risky.

Fong points out that most government offices dealing with sensitive data have long banned on-premise possession of smartphones. And beyond those specific instances, he says, "If you look at things like location trackers, think about revealing military bases and other types of facilities which shouldn't become known. It has to become a really big part of your thinking on strategic intelligence."

The danger from access to sensors extends beyond free apps. "It's probably one of the least-known things, that certain browsers or Web pages that gives you access to some data, capture measurement from sensors like the location, accelerometer, or magnetometer."

Wakeup Call

Enterprises are becoming more sensitive to the data being gathered from consumers in their roles as employees, Covington says.

"There is actually a movement towards app vetting within the enterprise," he says. That's where the security team vets not just the developer and where the app was downloaded, but also the information the app can collect - and how the publisher treats that information in transit and in back-end storage.

Meantime, some organizations are beginning to change their approach to apps on the devices employees bring. "Once they get this [app-vetting] workflow into place, I think you'll find much tighter controls on the applications that enterprises are allowing to be installed," says Covington.

Fong says the basic smartphone app hygiene that most companies require - don't click on unknown links or attachments, and only download apps from enterprise-approved app stores - is important, but not sufficient.

Defense-in-depth is a network security model that works for devices and their apps, because, as Fong says, total security requires process and awareness as well as security systems dedicated to protecting the enterprise from users' mobile devices.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Problem with Proprietary Testing: NSS Labs vs. CrowdStrike
Brian Monkman, Executive Director at NetSecOPEN,  7/19/2019
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13096
PUBLISHED: 2019-07-22
TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage. An attacker can read and reuse the user keystore of a valid user via /data/data/com.tronlink.wallet/shared_prefs/<wallet-name>.xml to gain unauthorized access.
CVE-2019-13097
PUBLISHED: 2019-07-22
The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. Attackers can manipulate users' score parameters exchanged between client and server.
CVE-2019-10102
PUBLISHED: 2019-07-22
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conver...
CVE-2019-12326
PUBLISHED: 2019-07-22
Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload (shell commands within the file) and trigger code execution.
CVE-2019-13100
PUBLISHED: 2019-07-22
The Send Anywhere application 9.4.18 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-root user to find out the username/password of a valid user via /data/data/com.estmob.android.sendanywhere/shared_prefs/sendanywhere_device.xml.