Developer Warns That Granting iPhone Camera Permissions Allows Apps to Secretly Capture You

[MacRumors]

Following the demonstration of a phishing attack that used Apple-style password requests to get into an iPhone user's Apple ID account, developer Felix Krause this week has detailed another proof-of-concept project, this time focused on the iPhone's cameras.

Krause warned that any time you grant an app permission to access your iPhone's front and back cameras, the app can secretly take pictures and videos of you as long as it's running in the foreground (via Motherboard).

Similar to his previous blog post, Krause's camera privacy project isn't about disclosing a new iOS bug, but more about warning users that this kind of privacy violation is possible within iOS. Many apps regularly request permission to the camera in iOS, allowing users to post photos from their Camera Roll, take a picture within the app without leaving it, and more.

Krause explained that with these permissions granted to a malicious app, the iPhone's front and back cameras can be turned on when that app is running. From there it could record content, upload it online, and even run real-time facial recognition software to detect emotions, all without indicating that your iPhone is recording you or your surroundings.

Image via Felix Krause​

Krause created a demo called watch.user to further emphasize his point, creating a fake social network app that tracks the user. As you browse, Krause explained, "you'll suddenly see pictures of yourself, taken a few seconds ago while you scrolled through the feed." In the image above, he explained that with a vision framework in iOS 11 a developer could even map someone's face to track their expressions, and Krause's mapping software displayed a corresponding emoji as a further proof of concept.

The developer said that there are "only a few things you can do" to potentially prevent this from happening, including purchasing camera covers to place over your iPhone's lenses. Otherwise, you have to revoke camera access for all apps -- which would greatly hinder the usefulness of many apps -- and instead always use Apple's built-in Camera app.

Krause reported the issue to Apple, and mentioned a few ways it could be potentially addressed:

- Offer a way to grant temporary access to the camera (e.g. to take and share one picture with a friend on a messaging app), related to detect.location.

- Show an icon in the status bar that the camera is active, and force the status bar to be visible whenever an app accesses the camera

- Add an LED to the iPhone's camera (both sides) that can't be worked around by sandboxed apps, which is the elegant solution that the MacBook uses

To double check which apps have access to your iPhone's cameras and photo library, navigate to the Settings app in iOS, tap Privacy, and there you'll find Photos and Camera. Apps that you've granted access to each will be listed, and you can change settings with toggles or choosing to "Never" allow access. As a point of emphasis, Krause's project isn't a bug or a major security breach you need to worry about, but it is a good reminder to ensure the apps you grant camera access to are trustworthy.

Article Link: Developer Warns That Granting iPhone Camera Permissions Allows Apps to Secretly Capture You

 

[D.T.]

This is exactly why I parade around in front of my iPhone in the nude ...

 

[Hater]

This is exactly why I parade around in front of my iPhone in the nude ...

I wonder if these app developers that do such things could go to jail for underage naked photos if one of the many under 18 phone users was nude while using their app.

 

[Moonjumper]

Another option for addressing the issue:

• An app must show an image of what the camera sees whenever the camera is active

 

[brianvictor7]

Some yahoo is going to hide some code in an app to detect when someone is running around in their birthday suits and then upload the pictures. Then, of course, Apple will get blamed for it for not screening the app properly and it will be an awful mess with a lot of hurt people.

 

[Menel]

Another option for addressing the issue:

• An app must show an image of what the camera sees whenever the camera is active

Your display screen on phone is far lower resolution than what the camera captures, so a lot of what it's captured is thrown away.

So why not just compress further to a 1x1 pixel image and display somewhere, maybe even perhaps rendered off screen

 

[Plutonius]

Privacy is an illusion.

 

[D.T.]

I wonder if these app developers that do such things could go to jail for underage naked photos if one of the many under 18 phone users was nude while using their app.

I'm sure, it's no different than stalking a child, taking photos without permission through a window. I was [obviously] joking, but this is pretty creepy.

 

[mdellepi]

But would an app secretly recording you pass the AppStore review process?

 

[Hater]

Another option for addressing the issue:

• An app must show an image of what the camera sees whenever the camera is active

Or, like laptops, have a little hard-wired-notification-of-webcam-enabled LED.

 

[macguru212]

This is exactly why I parade around in front of my iPhone in the nude ...

Yes, we know.

 

[berrymetal]

an LED indicator is the perfect solution, I hope apple adds that to future iPhone, iPads and iPods.

 

[Arty6]

It needs to be running in the foreground so what's the issue? The most it can do is see your face while your using it or the ground or a table behind the phone.

 

[Futurix]

So the app that was explicitly granted permission to use the camera can use it while you actively use the app? OUTRAGE!

I could see that as an issue if it would be able to still use the camera in the background - but it doesn’t!
So what’s the issue?

And iOS 11 introduced separate permissions for using camera and accessing photos - so apps can be more granular at permissions.

 

[Bug-Creator]

Newsflash:

Allowing an app to use the camera will allow the app to the camera !!!!!!!


*doh*

Solution:
Deny such request for any app that doesn't NEED the camera.
If the app asks again -> delete

 

[deanthedev]

Not this guy again. Always trying to get his 15 minutes of fame over some supposed security issue.

He was very deceitful last time over his Apple ID “proof of concept”, so not interested in what he has to say.

 

[Mascots]

I don’t just give apps access to my camera when any ol’ app asks, so there’s that. I can think of three apps with such access.

I think we’ll be fine in this case.

 

[Braderunner]

Yet another reason to not get the iPhone X until Apple has these issues worked out. Seriously...wait.

 

[JesperA]

Dump all photos taken by an app into an "app" folder in Photos or something so anyone who cares about this stuff can see what photos and/or screenshot every app has taken.

 

[Jsameds]

an LED indicator is the perfect solution, I hope apple adds that to future iPhone, iPads and iPods.

Or just a bar at the top of the screen like we have with audio recording.

 

[dschulian]

OMG, I have to trust app that I grant access to my device?! We're all gonna dieeeeeeee!
Maybe people shouldn't use all these crappy services (hello facebook), and Suckerberg should stop forcing us to give up our privacy in favor for their bank account. (Why do I have to log in to check the facebook page of an restaurant...)
I'm angry now, have to rewatch the South Park episode "Frenchise Prequel" now...

 

[newyorksole]

I don’t just give apps access to my camera when any ol’ app asks, so there’s that. I can think of three apps with such access.

I think we’ll be fine in this case.

I’d say we’ll be fine too...

I don’t think this is the end of the world or that someone is going to exploit you or I.

 

[ConfusedChris]

I once asked our son why he has a sticker over the front facing camera on his iPad. He said that he was once on his Windows laptop and the webcam had started transmitting live video to someone without permission.

 

[manu chao]

Some yahoo is going to hide some code in an app to detect when someone is running around in their birthday suits and then upload the pictures.

What is so bad about birthday suits?

 

[HacKage]

A couple of sarky comments along the lines of "If you grant permission, then duh". The problem is that it is recording covertly, while you are browsing normal content. There's no need to be a dick about it, there are numerous apps out there that you grant camera permission to, kids will use filter apps to edit their pics etc. How about when you're on the can browsing through an Instagram style app viewing content, totally oblivious to the fact that it is recording the whole thing? The ideal solution is the LED that the MacBooks have. Having that tie in with a notification light for the OS would be even better.