iOS reveals multiple secret backdoors, users are monitored every minute
|
Well-known iOS hacker Jonathan Zdziarski has discovered multiple undisclosed "backdoor" services in iOS that he believes could be used by law enforcement, the National Security Agency, or other malicious groups to bypass iOS' encryption and steal sensitive personal information. Zdziarski, an early iOS hacker and author of the book Hacking and Securing iOS Applications, disclosed the news of multiple backdoors in iOS during a speech at the annual HOPE/X hacker and developer conference. In his speech, Zdziarski talked about multiple services running in the background of iOS that he believes are not intended for app developers, Apple employees, or technical support staff. Other backdoors are intended for enterprise system administrators, but are designed in a way that allows them to be used for malicious purposes. "A lot of information should not leave the phone, even when backing up data," Zdziarski said of the information leaked by these background services. A service called com.apple.pcapd captures HTTP data flowing in and out of iOS devices using the libpcap network packet capture function package. According to Zadrsky, this service is activated by default on all iOS devices and can be used to monitor users' information over WiFi networks without their knowledge. Zadrsky specifically questioned the com.apple.mobile.file_relay service, which first appeared in iOS 2 and has been expanded in later versions. He said this service completely bypasses iOS's backup encryption feature and can leak "a lot of intelligence", including the user's address book, CoreLocation log, clipboard, calendar, voicemail, etc. Zadrsky pointed out that hackers can even use this service to steal users' recent photos, recent timeline content, users' DM databases, and authentication tokens from tweets, which can be used to "remotely steal all future Twitter messages." These secret services are not used by iTunes or Xcode, and the data is "too raw" to be used in the Genius Bar or restored to an iOS device. Zadrsky also talked about some of the features in iOS for enterprise customers, including mobile device management options that allow hackers to install customized spyware on devices by forging security certificates. Zadzirski used this method to develop a proof-of-concept spyware app. Apple has since fixed the vulnerability. Some of the backdoor services have been used by commercial law enforcement equipment manufacturers, including Elcomsoft, AccessData and Cellebrite, whose equipment is widely used by US law enforcement agencies to collect evidence from suspects' mobile devices. As a winner of Toutiao's Qingyun Plan and Baijiahao's Bai+ Plan, the 2019 Baidu Digital Author of the Year, the Baijiahao's Most Popular Author in the Technology Field, the 2019 Sogou Technology and Culture Author, and the 2021 Baijiahao Quarterly Influential Creator, he has won many awards, including the 2013 Sohu Best Industry Media Person, the 2015 China New Media Entrepreneurship Competition Beijing Third Place, the 2015 Guangmang Experience Award, the 2015 China New Media Entrepreneurship Competition Finals Third Place, and the 2018 Baidu Dynamic Annual Powerful Celebrity. |
>>: China Mobile: Upgrading to 4G without changing number or registration
Recommend
Cortana UI is like this now, why don’t you chat with it?
Hey, Cortana: Your mission is to make your daily ...
How much is the CBA championship prize money? How much prize money does the Guangdong team, the ten-time CBA champion, get?
As the fourth quarter of the third game of the fi...
How to explain sleeping in using physics?
It's really not my problem that I always want...
What are the benefits of promoting WeChat mini programs?
1. Mini Programs combined with official accounts ...
Is “supplementing what is lacking” precise nutrition? This is the key to cracking the code of longevity!
With the continuous deepening of the "Health...
4 ways to build an Internet brand!
Although the entry threshold for Internet brands ...
It's your car, but not entirely. What are the methods used by manufacturers to remotely lock it? This article will help you avoid pitfalls
The car you buy is not your car, or in other word...
Neither Trump's coming to power nor Wei Jianjun's cold water can change the chip narrative of China's electric vehicles
The US presidential election has come to an end. ...
The algorithm recommendation mechanism of Toutiao and Douyin is not as "stupid" as people say on the Internet!
In 1865, on the flat land outside Yongdingmen in ...
All things grow with the help of the sun. Is it possible to grow without it?
For reprinting, business cooperation, please scan...
Ford invested $4 billion to build autonomous driving, but can it catch up with Waymo?
On July 25, Ford announced the establishment of a...
How does BuzzFeed, the American version of Toutiao, achieve viral communication?
At the beginning of the year, Bytedance's XX ...
What is the abnormal weather phenomenon this year 2022? Why is it so abnormal? Specifically these are the three reasons!
Recently, the weather in many parts of my country...
Just count on your fingers, how much radiation is exposed when going through security check?
These problems, Do you know all the answers? Auth...
What is the relationship between Zhu Yuanzhang and Bach?
Leviathan Press: In 1616, the year Shakespeare di...