The story has begun days ago. As a result, she had to add Apple Lossless Audio CODEC (ALAC), μια νέα σελίδα στη γνωσιακή της βάση, προσπαθώντας να εξηγήσει τα ανεξήγητα. Τα ανεξήγητα ήρθαν στην επιφάνεια όταν ο ερευνητής ασφαλείας Jonathan Zdziarski, παρουσίασε ορισμένες αδήλωτες υπηρεσίες που αποκάλυψε στο operating system της εταιρείας. Η παρουσίαση του έγινε στο συνέδριο Hackers On Planet Earth (HOPE X) in New York.
Apple's documentation states that the tools presented by the expert have diagnostic purposes and require pairing with a trusted device.
However, the findings of Zdziarski (PDF) deny this type of use, and one of the reasons is that the service is enabled by default for all devices and runs without the owner knowing anything.
Apple, for its part, says "com.apple.mobile.pcapd," is a tool for tracking network traffic on your iOS device, and that it is useful for troubleshooting and diagnosing problems caused by applications on the device as well as VPN connections. ”
In his presentation, Zdziarski reports that the tool can be used through a remote WiFi connection to monitor something which, as he says, can be easily achieved without the owner's consent, and without any indication that the packet sniffer runs and leaks information.
"Com.apple.mobile.file_relay," and remote access, is presented by Zdziarski as a complete tool for eavesdropping on users' personal information, even bypassing backup encryption.
Provides access to address and contact file, photos, voicemail, data sound, keystrokes, drafts, accounts (Twitter, iCloud, Facebook, etc) device settings, as well as GPS logs. Another function creates a metadata disk about the device files.
Apple's documentation of the service states that "Apple's technique uses file_relay on internal devices to select customer configurations. AppleCare, with the user's consent, may use this tool to collect relevant diagnostic data from users' devices. ”
But the researcher claims that "mobile.file_relay" has access to information that is not necessary to diagnose a device and of course should not be available to Apple technicians.
Revealing all of this, Zdziarski does not blame Apple for cooperating with government agencies, although it has not received a response regarding their purpose when it came into contact with the company's last two CEOs.
But while the security spots he discovered can have legitimate uses, the details they can extract and share from the device are too personal, and he points out that government officials could well benefit from the functionality of these tools to espionage.
"I admit to Apple that it recognized and did not deny the services, and at least tried to give an answer to those who want to know why the services exist. Prior to that, there was no documentation for file relay, and 44 other data services that copied personal information. "
"The Apple Bulletin does not seem to be misleading to the processes, however, it does seem to degrade them, and that is something that worries me. "I wonder if senior Apple executives are really aware of how much information being copied and sent out of the device is personal information, does not aid in diagnosis and travels out wirelessly, bypassing backup encryption." See all the post.
What do you say? After Snowden's revelations to whom can we have confidence? On Apple's cognitive base trying to tell us they are intact and do not share information with governments, or the researcher?
