A celebrated Apple jailbreak hacker by the name of Jonathan Zdziarski told the HOPE/X hacker conference in New York that iOS has too much background traffic, and has asked Apple what is going on.
Jonathan Zdziarski, a hacker with the alias “NerveGas”, has accused Apple of having backdoors in iOS for government and other law-enforcement related snooping.
Mr Zdziarski was involved in jailbreaking iOS until version 4, wrote five iOS-related books for O’Reilly including “Hacking and Securing iOS Applications”, says he “designed all of the iOS forensics techniques used in law enforcement and commercial products today” and has “trained law enforcement worldwide in iOS forensics and penetration arts”, so he certainly has the credentials to be making such a claim.
The accusation against Apple was made at the HOPE/X “Hackers on Planet Earth” conference over the weekend in New York, which can be replayed here.
Mr Zdziarski’s extensive presentation, available here as a PDF, delves deeply into the various background actions iOS is taking, including ways to manually pair with the iPhone to suck data from its internals, despite encryption, passcode locks and fingerprint readers, and certainly asks some interesting questions.
Specific questions to Apple included:
– Why is there a packet sniffer running on 600 million personal iOS devices instead of moved to the developer mount?
– Why are there undocumented services that bypass user backup encryption that dump mass amounts of personal data from the phone?
– Why is most of my user data still not encrypted with the PIN or passphrase, enabling the invasion of my personal privacy by YOU?
– Why is there still no mechanism to review the devices my iPhone is paired with, so I can delete ones that don’t belong?
Financial Times journalist Tim Bradshaw decided to ask Apple about Mr Zdziarski’s HOPE/X presentation and questions, and tweeted part of Apple’s emailed response.
 Click to enlarge |
Apple is quoted to have said that: “We have designed iOS so that its diagnostic functions do not compromise user privacy and security, but still provides needed information to enterprise IT departments, developers and Apple for troubleshooting technical issues.
“A user must have unlocked their device and agreed to trust another computer before that computer is able to access this limited diagnostic data. The user must agree to share this information, and data is never transferred without their consent.
“As we have said before, Apple has never worked with any government agency from any country to create a backdoor in any of our products of service”, which is as far as Mr Bradshaw quoted.
Despite Apple’s denials, Mr Zdziarski’s presentation nevertheless asks important questions about why background activities of concern are taking place on iOS, including screenshot evidence in his presentation of iOS packet sniffing on iOS 7.x which could be affecting more than 600 million iOS users, claims Mr Zdziarski says have been put directly to Tim Cook by email, and previously to Steve Jobs by email when he was Apple CEO.
Mr Zdziarski says neither Apple CEO responded to his questions on security, but says Mr Cook did respond by email to a question regarding Apple warranty issues, which Mr Zdziarski says is proof that his emails on security are, at least, being read, if not responded to.
It is possible to disable diagnostic information from being sent to Apple within iOS Settings, as well as limiting ad tracking and disabling background updates for various iOS apps, but Mr Zdziarski’s presentation goes well beyond basic apps into the depths of iOS itself.
With Apple having the biggest market share of high-value smartphone, device and computer owners, Apple’s emphasis on security with its iOS third-party extensions, and general knowledge that companies like Google and Facebook really are doing deep data mining on users, it would seem Apple users either don’t know or don’t care that Apple is enabling some background activity for enterprise use and Apple technical troubleshooting.
Apple users are instead enjoying the sophistication of iOS, its wide app library and effectively malware-free status, but it never hurts to keep pressure up on all companies and governments to respect privacy laws and to uphold the law rather than going around it.
While no company is above suspicion, which will undoubtedly get even more intense under the watchful eyes of Mr Zdziarski and his hacker colleagues, it would certainly be interesting to see how Windows Phone OS, Android OS, BlackBerry OS and others stand up to the same scrutiny.
Until then, the great mobile OS wars continue, with security for and of end-users still just one of many fronts.
