4 ms·

Short of a serious undisclosed bug in iOS, malware should not be able to record keystrokes from other apps. But you are right in that if you don't trust the OS

Short of a serious undisclosed bug in iOS, malware should not be able to record keystrokes from other apps. But you are right in that if you don't trust the OS manufacturer not to be snooping on you, you can't trust the app. In addition to logging keystrokes they could be logging the contents of UI text controls as they are set. Even if you implement your own custom keyboard and UI controls and your own encryption prior to sending anything over a socket they could still be snapshotting the phone's framebuffer regularly. There's no way to reliably hide data that you can see visually (or data that has to be unencrypted in memory at some point, even if you don't see it) from the lowest levels of the OS. Having said all of that, they probably aren't doing any of this, but they could.

britta 13y ago
From a week ago, a proof of concept of this kind of bug, "Background Monitoring on Non-Jailbroken iOS 7 Devices": http://www.fireeye.com/blog/technical/2014/02/background-monitoring-on-non-jailbroken-ios-7-devices-and-a-mitigation.html http://www.fireeye.com/blog/technical/2014/02/background-mon... > iOS7 provides settings for "background app refresh". Disabling unnecessary app's background refreshing contributes to preventing the potential background monitoring. However, it can be bypassed. For example, an app can play music in the background without turning on its "background app refresh" switch. Thus a malicious app can disguise itself as a music app to conduct background monitoring.
- zeckalpha 13y ago
  I doubt this would get into the App store, but that's not the point, is it?
  - saurik 13y ago
    Of course, the idea is that the app would actually do something useful, would do that useful thing correctly, and only activate the malicious code for targetted users (none of which would be Apple testers).

britta 13y ago

From a week ago, a proof of concept of this kind of bug, "Background Monitoring on Non-Jailbroken iOS 7 Devices": http://www.fireeye.com/blog/technical/2014/02/background-monitoring-on-non-jailbroken-ios-7-devices-and-a-mitigation.html http://www.fireeye.com/blog/technical/2014/02/background-mon... > iOS7 provides settings for "background app refresh". Disabling unnecessary app's background refreshing contributes to preventing the potential background monitoring. However, it can be bypassed. For example, an app can play music in the background without turning on its "background app refresh" switch. Thus a malicious app can disguise itself as a music app to conduct background monitoring.

zeckalpha 13y ago
I doubt this would get into the App store, but that's not the point, is it?
- saurik 13y ago
  Of course, the idea is that the app would actually do something useful, would do that useful thing correctly, and only activate the malicious code for targetted users (none of which would be Apple testers).