A security researcher considered to be among the foremost experts in his field says that more than a half-billion mobile devices running Apple’s latest iOS operating system contain secret backdoors.
Jonathan Zdziarski, also known by his online alias “NerveGas,” told the audience attending his Friday morning presentation at the Hackers on Planet Earth conference in New York City that around 600 million Apple devices, including iPhones and tablets, contain hidden features that allow data to be surreptitiously slurped from those devices.
During Zdziarski’s HOPE presentation, “Identifying Backdoors, Attack Points and Surveillance Mechanisms in iOS Devices,” the researcher revealed that several undocumented forensic services are installed on every new iPhone and iPad, making it easier that ever for a third-party to pull data from those devices in order to compromise a target and take hold of their personal information, including pictures, text messages, voice recordings and more.
Among the hidden functions running on iOS devices, Zdziarski said, are programs called “pcapd,” “file_relay” and “file_relay.” If used properly, he added, those programs can allow anyone with the right means and methodology to pull staggering amounts of data from a targeted phone, even when the rightful owner suspects the device is sufficiently locked.
Zdziarski has previously exploited older versions of the iOS operating system and authored several books on mobile security. Even after raising multiple questions with Apple, however, he said he has yet to figure out why, exactly, the tech giant ships iOS devices with programs that appear to do nothing other than leak digital data.
According to the slides Zdziarski presented during Friday’s talk, there’s little reason to believe the functions are used to run diagnostics or help developers.
“Most services are not referenced by any known Apple software,” one slide says in part, and “the raw format of the data makes it impossible to put data back onto the phone, making useless for Genius Bar or carrier tech purposes.”
“The personal nature of the data makes it very unlikely as a debugging mechanism,” he added.
…
“Why is there a packet sniffer running on 600 million personal iOS devices instead of moved to the developer mount?” he asked in one slide. “Why are there undocumented services that bypass user backup encryption that dump mass amounts of personal data from the phone? Why is most of my user data still not encrypted with the PIN or passphrase, enabling the invasion of my personal privacy by YOU?”
Full article: 600 million Apple devices contain secret backdoors, researcher claims (Russia Today)
Global Geopolitics 