iPhone secretly tracks user location, say researchers
iOS 4 logs up to 100 locations daily in unencrypted file on iPhone, iPad and syncing computers
Computerworld - A pair of researchers have found that Apple iPhones and iPads track users' locations and store the data in an unencrypted file on the devices and on owners' computers.
The data, which appears to have been collected starting with iOS 4, which Apple released last summer, is in a SQLite file on iPhones and iPads with 3G capability, said Pete Warden, the founder of Data Science Toolkit and a former Apple employee, and Alasdair Allan, a senior research fellow at the University of Exeter.
The same file, named "consolidated.db," is also stored in the iOS backups made by iTunes on the Mac or Windows PC used to synchronize the iPhone or iPad.
Stored in the file in clear text are locations' longitude and latitude, a timestamp and other information, including Wi-Fi networks in range of the device.
About 100 data points per day are logged to the file, said Warden and Allan in a video posted on the O'Reilly Radar blog.
"There can be tens of thousands of data points in this file," said the pair in the blog post.
The data may be hard to extract remotely from an iPhone or iPad, but not impossible, said Charlie Miller, a noted Mac and iPhone vulnerability researcher, and a four-time winner at the Pwn2Own hacking contest.
"The file is in the root's directory, so apps, including Safari, won't have access," said Miller. "That's still bad, though."
To view the location file on an iPhone remotely, an attacker would have to exploit a pair of vulnerabilities, one to hack Safari -- likely by duping the user into visiting a malicious site -- then another to gain access to the root directory, Miller said. That's possible, but unlikely for most criminals.
Instead, he said the biggest threat was if a person lost his or her iPhone, or it was seized by authorities. "If you lose it, or it's taken when you're crossing a border, say, then the data is accessible," said Miller.
Allan echoed Miller in the video. "If you lose your phone, then all your movements for the last year are on that phone, and can be taken off," said Allan.
Graham Cluley, a senior security senior technology consultant with U.K.-based security company Sophos, pointed out that the backup file on a PC or Mac also poses a risk. "If you're not around, someone else can access the information on your home or work computer," said Cluley.
- Apple updates OS X Yosemite public beta
- Even rivals are waiting for Apple to get into wearables
- Apple preps final non-security Mavericks update
- New Yosemite dev preview may herald public beta update later this week
- iPhone 5C's China bust raises questions about Apple's pricing for '14 models
- Mac sales so far in '14 may signal share push
- China scrubs Apple's iPad and MacBooks from government buying list
- Circle the date: Apple's iPhone 6 event slated for Sept. 9
- Stable Mac prices fuel reliable profit engine
- Apple unveils minor bumps to MacBook Pro laptops
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- The business impact of BYOA: Five major challenges and how your enterprise can solve them This E-Book reviews five major challenges of BYOA with key subject matter experts and outlines how businesses can solve them.
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade.
- Peer 1's Mission Critical Cloud: Your Cloud, Your Way Peer 1 Hosting's Mission Critical Cloud offers the ultimate in flexible customization of infrastructure, resources and support. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!