Information Week: Hacker Claims Apple Can Spy On iPhone Users, Disable Apps Remotely

[bobolito]

Hacker Claims Apple Can Spy On iPhone Users, Disable Apps Remotely

Posted by Eric Zeman, Aug 7, 2008 10:42 AM

Apple may have opened up the iPhone to third-party applications, but it is keeping a very close eye on those apps. According to hacker Jonathan Zdziarski, the iPhone can "phone home" to tell Apple what apps are installed, and if Apple doesn't like what it sees on your iPhone, it can kill the offending application.

Oh man. Apple, please tell me you didn't open this can of worms for real. The iPhone Apps Store, fun while it may be, already has had its fair share of negative press. Several apps have been squashed with no explanation from Apple, and the SDK has angered many developers, who feel Apple's control over what sort of apps they can develop is onerous and restrictive.

Turns out that's not the half of it. MacRumors is reporting that Apple has set up a URL to keep a list of applications that it doesn't like. So far, nothing is on that list. In Zdziarski's words:

"This suggests that the iPhone calls home once in a while to find out what applications it should turn off. At the moment, no apps have been blacklisted, but by all appearances, this has been added to disable applications that the user has already downloaded and paid for, if Apple so chooses to shut them down.

I discovered this doing a forensic examination of an iPhone 3G. It appears to be tucked away in a configuration file deep inside CoreLocation."

MacRumors suggests that Apple will most likely only use this functionality to kill malware or other code it deems dangerous. But what about unsanctioned applications that are downloaded to unlocked iPhones? Will Apple keep tabs on the applications that unlocked iPhone users download and install? Will it kill apps it doesn't like, even if the user has paid for it?

All these questions remain unanswered.

The bigger one that lingers in my mind is, if Apple is keeping tabs on the applications I am downloading, what else is it keeping tabs on? My phone calls? My text messages? My browsing history? The type of content I chose to consume? I surely hope not, as that's a major breach of privacy.

Hacker Claims Apple Can Spy On iPhone Users, Disable Apps Remotely - Mobile Blog - InformationWeek

[bobolito]

Leave to Apple control freaks to do something like this. They are like a communist party. Give them a bit of power and they will figure out how to own you! They say it is only to remove malware, but this is precisely one of the things malware does!

Though we gotta thank the hackers. All they gotta do is release a small patch to disable this "home phone" sneaky code.

[spleck]

From AppleInsider | Gartner approves iPhone for limited enterprise use

iPhone gets a RIM-style remote wipe
In March, following Apple's announcement of the iPhone 2.0 release addressing support for enterprise management tools, including remote wipe from Exchange, Gartner's Dulaney quickly issued "An Interim Update on the Apple iPhone," calling it "a technological advance rarely seen in the industry," and noting that Gartner planned to endorse the handset under appliance-level support following the release of the enterprise improvements in iPhone 2.0.

Just days before the 2.0.1 release, Gartner finalized its approval of what it calls appliance-level support. "To achieve this level," Dulaney wrote, "the iPhone would need to support wireless e-mail and PIM for at least one popular enterprise e-mail system and include a minimum of two security policies: the ability to wipe the device of all data if lost or stolen, and a complex user password consisting of a coalpha, numeric and special characters in a pattern that cannot be easily guessed."

Gartner's testing found that the iPhone's remote wipe and strong password policy does work as advertised in a manner similar to Windows Mobile phones. The report explained, "As for setting these parameters, Microsoft uses a confusing approach, assuming that the end device will decide on what type of password will be enforced when the policy is received by the device. There is no feedback to the console that the policy has been enforced. Windows Mobile interprets the alphanumeric parameter as an instruction to force the user to employ a complex password. The iPhone replicates this function in the same manner, despite Microsoft's awkward implementation."

"Oops... we didn't mean to erase everything you had on your phone. We thought it was stolen."

[spleck]

Your iPhone probably isn't calling home, just might not want you up in its Core Location - Engadget Mobile

[Mobile Mike]

Originally Posted by bobolito

Leave to Apple control freaks to do something like this. They are like a communist party. Give them a bit of power and they will figure out how to own you! They say it is only to remove malware, but this is precisely one of the things malware does!

Though we gotta thank the hackers. All they gotta do is release a small patch to disable this "home phone" sneaky code.

Apple's beginning to resemble Big Red & Big Blue more and more every day...Strange bedfellows.