Become a MacRumors Supporter for $25/year with no ads, private forums, and more!

MacRumors

macrumors bot
Original poster
Apr 12, 2001
52,024
13,645



Uber_App_Icon-250x250.jpg
When the Apple Watch was first released, Apple gave Uber what's known as an "entitlement" to run a special API to improve performance of the Uber app on the wrist worn device.

That entitlement made headlines today when security researchers told Gizmodo that Uber could have used it to record a user's iPhone screen even with the Uber app just running in the background.

In a statement, Uber said the entitlement was used for an old version of the Apple Watch app and was provided to Uber because the original Apple Watch couldn't render maps.
"It was used for an old version of the Apple Watch app, specifically to run the heavy lifting of rendering maps on your phone & then send the rendering to the Watch app," an Uber spokesperson told Gizmodo, saying that early Apple Watches couldn't handle this process alone. "This dependency was removed with previous improvements to Apple's OS & our app. Therefore, we're removing this API from our iOS codebase."
The entitlement is no longer necessary and Uber is planning to remove it from the iOS codebase, according to both the statement given to Gizmodo and a tweet from Uber head of security and privacy communications Melanie Ensign.

According to security researcher Will Strafach, who first brought attention to the issue, Apple does not often give out entitlements. Strafach said he could find no other apps on the App Store that have the permissions that the Uber app has.

API was used to render Uber maps on iphone & send to Apple Watch before Watch apps could handle it. It's not in use & being removed. Thx! - Melanie Ensign (@iMeluny) October 5, 2017
Strafach says there is no evidence that Uber ever misused the entitlement, but it could have been utilized to monitor activity on an iPhone, recording passwords and other personal information. "Essentially it gives you full control over the framebuffer, which contains the colors of each pixel of your screen. So they can potentially draw or record the screen," another security researcher, Luca Todesco, told Gizmodo.

Uber says the app is no longer connected to anything in the company's current codebase, but users will likely be wary anyway as there have been other privacy concerns with the Uber app. There was a feature that allowed riders to be tracked for up to five minutes after a trip, and Apple CEO Tim Cook even went so far as to threaten to remove the app from the App Store after it was found to be secretly recording the UDID of iPhones to identify them even after the Uber app had been deleted.

Update: An Uber spokesperson said that an update released on Friday removed the API.

Article Link: Uber Removing Apple-Granted API That Could Have Let it Record a User's iPhone Screen [Updated]
 

CarlJ

macrumors 603
Feb 23, 2004
5,276
9,080
San Diego, CA, USA
This particular story sounds plausible the way it is explained, but I have permanent distrust for Uber, given how many shady/slimy things they have done in the past. I don't trust them to be able to reform, ever, given their long record of going out of their way to treat people horribly. Best for Apple to withdraw the entitlement and continue keeping a wary eye on Uber.
 
Comment

WannaGoMac

macrumors 68030
Feb 11, 2007
2,538
3,779
Apple is the one that gave them this capability. I am more upset with Apple than Uber. Was anyone told Uber was recording all actions on the device thanks to Apple?

Yet folks are upset with Uber??? Seems like Apple is in the wrong here...
 
Comment

Chupa Chupa

macrumors G5
Jul 16, 2002
14,834
7,394
Put down the pitchforks. This is an Apple-granted entitlement.

Well I think the pitchforks need to stay raised -- just pointed at Apple. One of the features Apple uses to sell it's devices is privacy. So how the h* did it not catch this before it gave it out to Uber -- apparently some time ago. Uber has made it's share of sketchy moves but this one is on Apple. It really needs to explain how this won't happen again.
 
Comment

Bacillus

Suspended
Jun 25, 2009
2,681
2,199
Huh !!!!??
Essentially, this backdoor could give any granted party access to anything any user does.
Isn't that exactly the backdoor that Tim assured it doesn't exist in the Nat. Security services discussion ?
 
Last edited:
Comment

CarlJ

macrumors 603
Feb 23, 2004
5,276
9,080
San Diego, CA, USA
Well I think the pitchforks need to stay raised -- just pointed at Apple. One of the features Apple uses to sell it's devices is privacy. So how the h* did it not catch this before it gave it out to Uber -- apparently some time ago. Uber has made it's share of sketchy moves but this one is on Apple. It really needs to explain how this won't happen again.
We haven't heard Apple's side of this. It's entirely possible that Apple has carefully monitored the Uber app to ensure it doesn't use the entitlement for shady purposes. I suspect it has gotten considerable attention from Apple since Uber and its app were found to be actively trying to dodge Apple's vetting process. It sounds like you're making the assumption that Apple was asleep at the wheel. I don't know that that is the case. Do you have evidence otherwise?
[doublepost=1507238065][/doublepost]
Was anyone told Uber was recording all actions on the device thanks to Apple?
Has anyone shown that Uber was, indeed, recording all actions on the device? Or are you just assuming that? What I got from the article was that their app had a grant of special permissions that could have been used to do that, not that they actually did it.
[doublepost=1507238293][/doublepost]
If Apple is issuing the "entitlement", why aren't they also vetting its use?
Where have you read authoritative statements that Apple wasn't vetting its use?

To be clear, I don't like Uber, I think they've done horrible things. But it seems like a lot of people are reading "could have used this API to..." and conveniently ignoring the "could have" and treating this as proof that they did use the API in the way proposed by the security researchers. I've seen no evidence that warrants this leap to judgement. Unless you just really like pitchforks. There's enough things to get upset about that Uber has done. No need to get upset at hypotheticals, unless/until they are proved true.
 
Last edited:
Comment

Tech198

macrumors P6
Mar 21, 2011
15,674
2,091
Australia, Perth
first fingering printing now this. Uber's track record is the shadiest.


Bugger you Uber..!! so if Uber could still identify you even after the app was deleted, what does that say about anything else then? Not saying it would happen, but if Uber did it, then why not others?
 
  • Like
Reactions: stevekr
Comment

whizstachio

macrumors newbie
Jul 26, 2016
23
91



Uber_App_Icon-250x250.jpg
When the Apple Watch was first released, Apple gave Uber what's known as an "entitlement" to run a special API to improve performance of the Uber app on the wrist worn device.

That entitlement made headlines today when security researchers told Gizmodo that Uber could have used it to record a user's iPhone screen even with the Uber app just running in the background.

In a statement, Uber said the entitlement was used for an old version of the Apple Watch app and was provided to Uber because the original Apple Watch couldn't render maps.The entitlement is no longer necessary and Uber is planning to remove it from the iOS codebase, according to both the statement given to Gizmodo and a tweet from Uber head of security and privacy communications Melanie Ensign.

According to security researcher Will Strafach, who first brought attention to the issue, Apple does not often give out entitlements. Strafach said he could find no other apps on the App Store that have the permissions that the Uber app has.

Strafach says there is no evidence that Uber ever misused the entitlement, but it could have been utilized to monitor activity on an iPhone, recording passwords and other personal information. "Essentially it gives you full control over the framebuffer, which contains the colors of each pixel of your screen. So they can potentially draw or record the screen," another security researcher, Luca Todesco, told Gizmodo.

Uber says the app is no longer connected to anything in the company's current codebase, but users will likely be wary anyway as there have been other privacy concerns with the Uber app. There was a feature that allowed riders to be tracked for up to five minutes after a trip, and Apple CEO Tim Cook even went so far as to threaten to remove the app from the App Store after it was found to be secretly recording the UDID of iPhones to identify them even after the Uber app had been deleted.

Article Link: Uber Removing Apple-Granted API That Could Have Let it Record a User's iPhone Screen
[doublepost=1507238831][/doublepost]I no longer trust Apple
 
Comment

TheIntruder

macrumors 65816
Jul 2, 2008
1,363
870
This company is constantly involved in scandal. I don't know why Apple deals with it. They are dishonest, they have no integrity. Ban them.

$$$$

Apple "commitment" to the user privacy only goes as far as not impacting its business.

Uber's surreptitious and deceptive actions in going so far as to actively conceal its violation of Apple's guidelines (not to mention Project Greyball) was as much as any principled leader would have needed to flick the app from the store.

That would have happened with any lesser developer. But, Uber's market position, and potential user backlash was too much for Cook to do anything but let them off with a scolding. Money > principle.

Don't fall for the hype. Ultimately, nobody has your own interests as heart except you. Certainly not these multi-$B corporations.
 
Comment

mw360

macrumors 68000
Aug 15, 2010
1,740
1,820
I looked at the Gizmodo article. Here's where I stopped reading...

"Alternatively, it’s possible that Apple sandboxed the entitlement to prevent it from accessing data outside Uber’s app."

That Apple built in safeguards to prevent abuse is exactly the first thing I though of. Shame nobody else wants to find out that part before getting all fired up.
 
Last edited:
Comment

cmwade77

macrumors 65816
Nov 18, 2008
1,065
1,179
I stick with Lyft the 2 or 3 times a year I need such a service because their drivers are nicer in general, but then add in all of these issues and you really do want to stick with Lyft or other competitors to Uber.
 
Comment
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.