8 ms·

iPhone Apps Surreptitiously Communicated with Unknown Servers

102 points by hsnewman 7y ago

Anechoic 7y ago
Previous discussion: https://news.ycombinator.com/item?id=20031443 https://news.ycombinator.com/item?id=20031443
mrgreenfur 7y ago
Are there any firewall style apps to block this type of behavior? Something like uBlock or uMatrix but for apps. I'm not inclined to trust any apps and would prefer explicit control over what they do. Also, it's a bit strange to me that we didn't/don't seem to have this explosion of data leakage for desktop apps despite them having unique ids just like on mobile (idfa/google ad id).
- Despegar 7y ago
  You can use Will Strafach's new app Guardian that blocks trackers in apps. I think Apple is going to purge them from iOS apps over time, they've already started with kids apps. https://guardianapp.com/ https://guardianapp.com/
  - sascha_sl 7y ago
    it's a vpn from all i see cloud firewalls are their own brand of yikes, unless you run them yourself
    - chatmasta 7y ago
      It could be implemented as a local VPN server using the NetworkExtension API.
      - sascha_sl 7y ago
        It's not though, typical VPN provider claims. Network Traffic Encryption Protect all passwords, communications, and other sensitive network data with AES-256 encryption, mitigating any attempts to monitor your electronic activity.
  - wool_gather 7y ago
    Very interesting technique: the firewall is remote. > The Guardian Firewall app has been designed to simply act as a client for remotely hosted VPN servers running custom fully-featured firewall software... (From https://guardianapp.com/blog/2019/06/introducing-guardian-firewall-for-ios/ https://guardianapp.com/blog/2019/06/introducing-guardian-fi...) I wondered at first why the VPN was free but you had to pay for the firewall.
  - reaperducer 7y ago
    I think Apple is going to purge them from iOS apps over time, they've already started with kids apps. To be clear, Apple isn't purging apps that protect kids in favor of its own apps. Its my understanding that Apple is purging apps that take over the phone entirely (including the ability to remotely control the camera and microphone) by misusing enterprise certificates. There are plenty of kid protection apps out there that play by the rules and will continue to work.
    - graeme 7y ago
      I think OP meant purging trackers from kids apps. https://www.macrumors.com/2019/05/31/apple-to-limit-third-party-tracking-in-kids-apps/ https://www.macrumors.com/2019/05/31/apple-to-limit-third-pa...
    - Clent 7y ago
      I believe the parent was referring to a change in Apple's guidelines that was making the rounds a couple of weeks ago, “Apps intended for kids may not include third-party advertising or analytics” This was previously discussed here https://news.ycombinator.com/item?id=20108096 https://news.ycombinator.com/item?id=20108096
    - Despegar 7y ago
      As the other comments mentioned, I meant purging trackers from iOS apps. There's a privacy reason to do it but also a business reason. Apple shouldn't have apps on their platform with dependencies to major competitors like Google and Facebook. And it's probably going to be ruled illegal anyway after the GDPR cases get litigated, so it's better to get ahead of it.
  - wtmt 7y ago
    This app does not work in all countries and regions as yet. The pricing for the firewall capability also seems to be on the higher side: "The cost is $9.99/month (or $99.99 per year) for VPN + Firewall capabilities. VPN-only service will be available at no cost." [1] [1]: https://guardianapp.com/blog/2019/06/introducing-guardian-firewall-for-ios/ https://guardianapp.com/blog/2019/06/introducing-guardian-fi...
    - stefan_ 7y ago
      And the VPN-only part is free, but it's not a locally emulated VPN. I'm gonna take a wild guess of how that particular service is financed.
- bonjurkes 7y ago
  You can use Pi Hole both on your local network and on cloud as VPN on your iPhone (only DNS or for full traffic)
  - close04 7y ago
    DNS filtering can only do so much. For apps that hardcode addresses you'd have to set up your own firewall. And then to protect yourself when you are "in the wild" you'd have to use an always on VPN to your own network. There might be commercial products that do this for you. Setting this up is definitely outside of the comfort zone for the overwhelming majority of phone users.
    - benologist 7y ago
      One of the main things Pi-hole does is give you transparency into what domains are being contacted and with what frequency, so you can identify and block relevant domains manually. https://discourse-cdn.pi-hole.net/uploads/default/original/2X/7/76219b47f24ad298d3dd9f0e3361ca6eee73d59b.jpeg https://discourse-cdn.pi-hole.net/uploads/default/original/2... https://discourse.pi-hole.net/uploads/default/original/2X/5/550320e5b8541985335a9cd6a31ea6e3ccea24df.jpg https://discourse.pi-hole.net/uploads/default/original/2X/5/...
      - stordoff 7y ago
        Not if the analytics companies start being contacted by hardcoded IP address, or the apps otherwise avoid DNS. May not by a common technique now, but it could become one.
        lostlogin 7y ago
        All of this describes my Chromecast nicely. There are others that do it too. Forcing this traffic through the Pihole isn’t always helpful though, as blocking it entirely breaks the Chromecast (which is used mainly for playing local media).
      - close04 7y ago
- Blackstone4 7y ago
  A while back I used NoRoot Firewall on Android which works as a “local VPN” funnelling all web tragic through the app and you whitelist every outbound connection. Only thing is that you don’t always have enough context on each IP address for each app to make an informed decision.
- duhi88 7y ago
  The article mentions one.
awinter-py 7y ago
running software is inherently unsafe -- beyond legit security threats where an app is getting information you haven't granted it, their use of sensitive information you have permitted needs to be more carefully audited of course they're sometimes violating their privacy policy -- no real history of punishment / legal consequences here except (1) at the highest size scale (FB / G), and even they get away with minor fines in the US. And (2) sometimes terms get read by courts in other matters, i.e. zappos. Plus product probably doesn't know the policy at some small companies; lawyers don't get involved enough. the solution here is much stronger OS-level permissions models that can track the provenance of sensitive information. very big difference between my location getting uploaded as part of a 'search nearby' (i.e. a click) vs in the background. sensitive information should audit every read and should be required to dump communication messages to an audit DB visible to the user. this is an area where open source can lead because it's easier for us to both run a policy checker / privacy linter and prove that it's running.
- swiley 7y ago
  I would argue that a far better solution is community maintained software like what’s used on many open source OSes. Occasionally these end up with backdoors inserted by large governments but it’s no where near as bad as what happens with smartphone apps.
  - Fnoord 7y ago
    Open source and smartphone apps is not mutually exclusive. I guess you mean you want open source smartphone apps instead of closed source / proprietary smartphone apps. There are some. For example, Marcel Bokhorst developed the following applications: NetGuard, XPrivacyLua, and FairEmail [1] [1] https://github.com/M66B https://github.com/M66B
    - swiley 7y ago
      Note my phrasing, I'm aware of OSS apps. I'm sure the development experience is less extreme on android but smartphone development is nothing like the experience on the PC where dev tools (visual basic/TCL/python/bash even gcc) are very lightweight and easy to work with. On the iphone you actually have to send apple money and sometimes even fax them a copy of your drivers license. Yes, you can have "open source smartphone apps" (although it's much closer to source available since the users really have no way to modify it) but you absolutely can't have community maintained software (again, on the iphone. You can on android in theory but the tooling really doesn't seem built for sharing with other people.)
dpkonofa 7y ago
Why is this titled this way? This is not inherent or specific to iPhones. The title should really be "Apps can do whatever you let them including send your data to unknown servers". This is the worst kind of piggyback article out there. It's piggybacking on another, more detailed source and it's using the term "iPhone" just to be more sensationalized.
- iamnotacrook 7y ago
  "Why is this titled this way? This is not inherent or specific to iPhones." My guess is that it's because that's what the article is about. Specific, named apps (for example "DoorDash"), running on an iPhone, and sending specific, named data ("device name, model, ad identifier and memory size") to other companies servers. So it's a very accurate title. It's bizarre to complain about this with whatabout statements. It's like reading an article about soldiers from a given country killing civilians and saying that we already knew this, and that soldiers from other countries do it too. So what? This story is about this specific instance of it.
  - dpkonofa 7y ago
    Ok but that entire insinuation is disingenuous. The article is taking a statement that Tim Cook made about what happens on an iPhone users phone in terms of Messages, FaceTime, and Apple Pay and is attempting to apply it to the entire App Store when that's never ever been the argument Apple's making. If anything, Apple is the only company that's tried to educate users about their data and isn't actively seeking to make a profit off that data. And even your "whatabout" complaint seems disingenuous. This is more like reading an article that says that the US government is killing innocent civilians and then someone pointing out that the civilians were actually killed by an individual that worked for a contracting company that the US government hired. You can't, in good faith, make the connection that the actions of an individual somehow equate to the actions of the whole organization just because there was some tangential relationship. Apple doesn't do this. Full stop. Specific apps do it and they do it regardless of the platform. This has nothing to do with Apple and the article, source and re-post, are simply dragging Apple into it for clickbait headlines.
wil421 7y ago
Are these just the 3rd party analytics servers used by a lot of Apps? My UniFi dashboard always shows spikes around 3-5am. I figured it was mostly iCloud backups.
newscracker 7y ago
Not directly related to the apps mentioned in this article, but one key permission that iOS lacks that Android has is the network access permission. There are many apps that I just don't want accessing the network or the Internet at all. I want them to run as local pieces of software with whatever other permissions I choose to grant them. Even in our connected world, there is no reason to provide blanket network access to every app on the device.
- jimbo1qaz 7y ago
  Android does have the FULL_INTERNET_ACCESS permission, but the UI hides it pretty well, to discourage people from rejecting apps with advertising.
- ignoramous 7y ago
  Yes, that and not being able to root a device is also restricting in some sense for power users. You'd be surprised that some of the most popular OEMs (Xiaomi, and the Oppo trifecta) have removed the ability to restrict specific apps from using data. Some OEMs do remove certain security and privacy oriented user settings like Private DNS, for instance. If you can root a device, you're good to go. There's no such escape with Apple, for both the developers (a good thing given Apple's privacy charm offensive) and the users.
  - dymk 7y ago
    > If you can root a device, you're good to go If you can root the device, bad actors can root the device, and all the nice security/isolation guarantees made by the OS are moot.
    - ignoramous 7y ago
      It's a two way street and not for everyone (note that, I mentioned no-root restricts power users, not everyone), yes, but being able to root an Android device is the reason extensions like XposedMod+XPrivacyLua (uMatrix for all apps) and tools like Frida.re (dynamic and static reverse engineering) exist. I don't see laptops sold without root due to security implications. Why the distinction for handheld devices? That said, I do get there's a lot of malware on laptops, and a malware being able to assume root is game over. So, I kind of get your point too (not necessarily agree with it).
3xblah 7y ago
Is there a reason to keep wifi enabled on a mobile phone while one is sleeping? There are certainly reasons against it. For one, it drains battery when one is not using the device. Unless I am downloading something while I sleep, I disable the interfaces on computers while I am asleep. If I control the gateway that the mobile phone uses, then I can disable the interface on the gateway.
- heywire 7y ago
  Turn it off and it'll just use the mobile networks instead. Turn that off, and now you won't get phone calls or text messages. I guess you could go and turn off mobile data for apps too, but its not like they won't just upload that data once you flip wifi back on...
  - duhi88 7y ago
    This is what I do. If an app doesn't need an internet connection, it can't access the internet.
    - DavideNL 7y ago
      > "but its not like they won't just upload that data once you flip wifi back on..."
      - 3xblah 7y ago
        Only if gateway is up. I can't really control a mobile phone loaded with a corpotate OS (I guess this is the point the replies are trying to make), but I can significantly control a router loaded with an OS I edited, compiled and installed myself. I have found that I can reliably keep a mobile phone from getting access to the internet when it is relying on me provding the internet access.
  - 3xblah 7y ago
    Have mobile data turned off. Only use in emergencies where no wifi available. Don't use many third party apps and, on Android phones, the only ones are sideloaded. Disabled Google's app store. Still get cellular calls and texts when wifi and mobile data are off. Background data disabled too, FWIW. Not really keen on mobile phones because despite the deep cascades of settings I do not feel I am really in control of them. Prefer computers where can easily compile and install own choice of UNIX-like OS.
dep_b 7y ago
The funny thing is that Safari works really great blocking all this kind of stuff on websites. So I want what Safari does, in all of my apps _unless I opt-in_.

102 points by hsnewman 7y ago

Previous discussion: https://news.ycombinator.com/item?id=20031443 https://news.ycombinator.com/item?id=20031443

Are there any firewall style apps to block this type of behavior? Something like uBlock or uMatrix but for apps. I'm not inclined to trust any apps and would prefer explicit control over what they do. Also, it's a bit strange to me that we didn't/don't seem to have this explosion of data leakage for desktop apps despite them having unique ids just like on mobile (idfa/google ad id).

Despegar 7y ago
You can use Will Strafach's new app Guardian that blocks trackers in apps. I think Apple is going to purge them from iOS apps over time, they've already started with kids apps. https://guardianapp.com/ https://guardianapp.com/
- sascha_sl 7y ago
  it's a vpn from all i see cloud firewalls are their own brand of yikes, unless you run them yourself
  - chatmasta 7y ago
    It could be implemented as a local VPN server using the NetworkExtension API.
    - sascha_sl 7y ago
      It's not though, typical VPN provider claims. Network Traffic Encryption Protect all passwords, communications, and other sensitive network data with AES-256 encryption, mitigating any attempts to monitor your electronic activity.
- wool_gather 7y ago
  Very interesting technique: the firewall is remote. > The Guardian Firewall app has been designed to simply act as a client for remotely hosted VPN servers running custom fully-featured firewall software... (From https://guardianapp.com/blog/2019/06/introducing-guardian-firewall-for-ios/ https://guardianapp.com/blog/2019/06/introducing-guardian-fi...) I wondered at first why the VPN was free but you had to pay for the firewall.
- reaperducer 7y ago
  I think Apple is going to purge them from iOS apps over time, they've already started with kids apps. To be clear, Apple isn't purging apps that protect kids in favor of its own apps. Its my understanding that Apple is purging apps that take over the phone entirely (including the ability to remotely control the camera and microphone) by misusing enterprise certificates. There are plenty of kid protection apps out there that play by the rules and will continue to work.
  - graeme 7y ago
    I think OP meant purging trackers from kids apps. https://www.macrumors.com/2019/05/31/apple-to-limit-third-party-tracking-in-kids-apps/ https://www.macrumors.com/2019/05/31/apple-to-limit-third-pa...
  - Clent 7y ago
    I believe the parent was referring to a change in Apple's guidelines that was making the rounds a couple of weeks ago, “Apps intended for kids may not include third-party advertising or analytics” This was previously discussed here https://news.ycombinator.com/item?id=20108096 https://news.ycombinator.com/item?id=20108096
  - Despegar 7y ago
    As the other comments mentioned, I meant purging trackers from iOS apps. There's a privacy reason to do it but also a business reason. Apple shouldn't have apps on their platform with dependencies to major competitors like Google and Facebook. And it's probably going to be ruled illegal anyway after the GDPR cases get litigated, so it's better to get ahead of it.
- wtmt 7y ago
  This app does not work in all countries and regions as yet. The pricing for the firewall capability also seems to be on the higher side: "The cost is $9.99/month (or $99.99 per year) for VPN + Firewall capabilities. VPN-only service will be available at no cost." [1] [1]: https://guardianapp.com/blog/2019/06/introducing-guardian-firewall-for-ios/ https://guardianapp.com/blog/2019/06/introducing-guardian-fi...
  - stefan_ 7y ago
    And the VPN-only part is free, but it's not a locally emulated VPN. I'm gonna take a wild guess of how that particular service is financed.
bonjurkes 7y ago
You can use Pi Hole both on your local network and on cloud as VPN on your iPhone (only DNS or for full traffic)
- close04 7y ago
  DNS filtering can only do so much. For apps that hardcode addresses you'd have to set up your own firewall. And then to protect yourself when you are "in the wild" you'd have to use an always on VPN to your own network. There might be commercial products that do this for you. Setting this up is definitely outside of the comfort zone for the overwhelming majority of phone users.
  - benologist 7y ago
    One of the main things Pi-hole does is give you transparency into what domains are being contacted and with what frequency, so you can identify and block relevant domains manually. https://discourse-cdn.pi-hole.net/uploads/default/original/2X/7/76219b47f24ad298d3dd9f0e3361ca6eee73d59b.jpeg https://discourse-cdn.pi-hole.net/uploads/default/original/2... https://discourse.pi-hole.net/uploads/default/original/2X/5/550320e5b8541985335a9cd6a31ea6e3ccea24df.jpg https://discourse.pi-hole.net/uploads/default/original/2X/5/...
    - stordoff 7y ago
      Not if the analytics companies start being contacted by hardcoded IP address, or the apps otherwise avoid DNS. May not by a common technique now, but it could become one.
      - lostlogin 7y ago
        All of this describes my Chromecast nicely. There are others that do it too. Forcing this traffic through the Pihole isn’t always helpful though, as blocking it entirely breaks the Chromecast (which is used mainly for playing local media).
    - close04 7y ago
Blackstone4 7y ago
A while back I used NoRoot Firewall on Android which works as a “local VPN” funnelling all web tragic through the app and you whitelist every outbound connection. Only thing is that you don’t always have enough context on each IP address for each app to make an informed decision.
duhi88 7y ago
The article mentions one.

awinter-py 7y ago

running software is inherently unsafe -- beyond legit security threats where an app is getting information you haven't granted it, their use of sensitive information you have permitted needs to be more carefully audited of course they're sometimes violating their privacy policy -- no real history of punishment / legal consequences here except (1) at the highest size scale (FB / G), and even they get away with minor fines in the US. And (2) sometimes terms get read by courts in other matters, i.e. zappos. Plus product probably doesn't know the policy at some small companies; lawyers don't get involved enough. the solution here is much stronger OS-level permissions models that can track the provenance of sensitive information. very big difference between my location getting uploaded as part of a 'search nearby' (i.e. a click) vs in the background. sensitive information should audit every read and should be required to dump communication messages to an audit DB visible to the user. this is an area where open source can lead because it's easier for us to both run a policy checker / privacy linter and prove that it's running.

swiley 7y ago
I would argue that a far better solution is community maintained software like what’s used on many open source OSes. Occasionally these end up with backdoors inserted by large governments but it’s no where near as bad as what happens with smartphone apps.
- Fnoord 7y ago
  Open source and smartphone apps is not mutually exclusive. I guess you mean you want open source smartphone apps instead of closed source / proprietary smartphone apps. There are some. For example, Marcel Bokhorst developed the following applications: NetGuard, XPrivacyLua, and FairEmail [1] [1] https://github.com/M66B https://github.com/M66B
  - swiley 7y ago
    Note my phrasing, I'm aware of OSS apps. I'm sure the development experience is less extreme on android but smartphone development is nothing like the experience on the PC where dev tools (visual basic/TCL/python/bash even gcc) are very lightweight and easy to work with. On the iphone you actually have to send apple money and sometimes even fax them a copy of your drivers license. Yes, you can have "open source smartphone apps" (although it's much closer to source available since the users really have no way to modify it) but you absolutely can't have community maintained software (again, on the iphone. You can on android in theory but the tooling really doesn't seem built for sharing with other people.)

dpkonofa 7y ago

Why is this titled this way? This is not inherent or specific to iPhones. The title should really be "Apps can do whatever you let them including send your data to unknown servers". This is the worst kind of piggyback article out there. It's piggybacking on another, more detailed source and it's using the term "iPhone" just to be more sensationalized.

iamnotacrook 7y ago
"Why is this titled this way? This is not inherent or specific to iPhones." My guess is that it's because that's what the article is about. Specific, named apps (for example "DoorDash"), running on an iPhone, and sending specific, named data ("device name, model, ad identifier and memory size") to other companies servers. So it's a very accurate title. It's bizarre to complain about this with whatabout statements. It's like reading an article about soldiers from a given country killing civilians and saying that we already knew this, and that soldiers from other countries do it too. So what? This story is about this specific instance of it.
- dpkonofa 7y ago
  Ok but that entire insinuation is disingenuous. The article is taking a statement that Tim Cook made about what happens on an iPhone users phone in terms of Messages, FaceTime, and Apple Pay and is attempting to apply it to the entire App Store when that's never ever been the argument Apple's making. If anything, Apple is the only company that's tried to educate users about their data and isn't actively seeking to make a profit off that data. And even your "whatabout" complaint seems disingenuous. This is more like reading an article that says that the US government is killing innocent civilians and then someone pointing out that the civilians were actually killed by an individual that worked for a contracting company that the US government hired. You can't, in good faith, make the connection that the actions of an individual somehow equate to the actions of the whole organization just because there was some tangential relationship. Apple doesn't do this. Full stop. Specific apps do it and they do it regardless of the platform. This has nothing to do with Apple and the article, source and re-post, are simply dragging Apple into it for clickbait headlines.

wil421 7y ago

Are these just the 3rd party analytics servers used by a lot of Apps? My UniFi dashboard always shows spikes around 3-5am. I figured it was mostly iCloud backups.

newscracker 7y ago

Not directly related to the apps mentioned in this article, but one key permission that iOS lacks that Android has is the network access permission. There are many apps that I just don't want accessing the network or the Internet at all. I want them to run as local pieces of software with whatever other permissions I choose to grant them. Even in our connected world, there is no reason to provide blanket network access to every app on the device.

jimbo1qaz 7y ago
Android does have the FULL_INTERNET_ACCESS permission, but the UI hides it pretty well, to discourage people from rejecting apps with advertising.
ignoramous 7y ago
Yes, that and not being able to root a device is also restricting in some sense for power users. You'd be surprised that some of the most popular OEMs (Xiaomi, and the Oppo trifecta) have removed the ability to restrict specific apps from using data. Some OEMs do remove certain security and privacy oriented user settings like Private DNS, for instance. If you can root a device, you're good to go. There's no such escape with Apple, for both the developers (a good thing given Apple's privacy charm offensive) and the users.
- dymk 7y ago
  > If you can root a device, you're good to go If you can root the device, bad actors can root the device, and all the nice security/isolation guarantees made by the OS are moot.
  - ignoramous 7y ago
    It's a two way street and not for everyone (note that, I mentioned no-root restricts power users, not everyone), yes, but being able to root an Android device is the reason extensions like XposedMod+XPrivacyLua (uMatrix for all apps) and tools like Frida.re (dynamic and static reverse engineering) exist. I don't see laptops sold without root due to security implications. Why the distinction for handheld devices? That said, I do get there's a lot of malware on laptops, and a malware being able to assume root is game over. So, I kind of get your point too (not necessarily agree with it).

3xblah 7y ago

Is there a reason to keep wifi enabled on a mobile phone while one is sleeping? There are certainly reasons against it. For one, it drains battery when one is not using the device. Unless I am downloading something while I sleep, I disable the interfaces on computers while I am asleep. If I control the gateway that the mobile phone uses, then I can disable the interface on the gateway.

heywire 7y ago
Turn it off and it'll just use the mobile networks instead. Turn that off, and now you won't get phone calls or text messages. I guess you could go and turn off mobile data for apps too, but its not like they won't just upload that data once you flip wifi back on...
- duhi88 7y ago
  This is what I do. If an app doesn't need an internet connection, it can't access the internet.
  - DavideNL 7y ago
    > "but its not like they won't just upload that data once you flip wifi back on..."
    - 3xblah 7y ago
      Only if gateway is up. I can't really control a mobile phone loaded with a corpotate OS (I guess this is the point the replies are trying to make), but I can significantly control a router loaded with an OS I edited, compiled and installed myself. I have found that I can reliably keep a mobile phone from getting access to the internet when it is relying on me provding the internet access.
- 3xblah 7y ago
  Have mobile data turned off. Only use in emergencies where no wifi available. Don't use many third party apps and, on Android phones, the only ones are sideloaded. Disabled Google's app store. Still get cellular calls and texts when wifi and mobile data are off. Background data disabled too, FWIW. Not really keen on mobile phones because despite the deep cascades of settings I do not feel I am really in control of them. Prefer computers where can easily compile and install own choice of UNIX-like OS.

dep_b 7y ago

The funny thing is that Safari works really great blocking all this kind of stuff on websites. So I want what Safari does, in all of my apps _unless I opt-in_.