[FireEye]Background Monitoring on Non-Jailbroken iOS 7 Devices -- and a Mitigation

[igor51]

Background Monitoring on Non-Jailbroken iOS 7 Devices -- and a Mitigation

Background monitoring mobile applications has become a hot topic on
  mobile devices. Existing reports show that such monitoring can be
  conducted on jailbroken iOS devices. FireEye mobile security
  researchers have discovered such vulnerability, and found approaches
  to bypass Apple's app review process effectively and exploit
  non-jailbroken iOS 7 successfully. We have been collaborating with
  Apple on this issue.

      src="https://www.fireeye.com/content/dam/legacy/blog/2014/02/fig1.png"
    width="220" height="280" class="portrait-sm" />
 

 

Fig.1 Background Monitoring

We have created a proof-of-concept "monitoring" app on
  non-jailbroken iOS 7.0.x devices. This “monitoring” app can record all
  the user touch/press events in the background, including, touches on
  the screen, home button press, volume button press, and TouchID press,
  and then this app can send all user events to any remote server, as
  shown in Fig.1. Potential attackers can use such information to
  reconstruct every character the victim inputs.

Note that the demo exploits the latest 7.0.4 version of iOS system on
  a non-jailbroken iPhone 5s device successfully. We have verified that
  the same vulnerability also exists in iOS versions 7.0.5, 7.0.6, and
  6.1.x. Based on the findings, potential attackers can either use
  phishing to mislead the victim to install a malicious/vulnerable app
  or exploit another remote vulnerability of some app, and then conduct
  background monitoring.

 

 

 

          src="https://www.fireeye.com/content/dam/legacy/blog/2014/02/fig2.png"
      width="157" height="280" class="portrait-sm" />
   

   

Fig.2 Background App Refresh Settings

 

 

 

          src="https://www.fireeye.com/content/dam/legacy/blog/2014/02/fig3.png"
      width="157" height="280" class="portrait-sm" />
   

   

Fig.3 Killing An App on iOS7

 

 

iOS7 provides settings for "background app refresh".
  Disabling unnecessary app's background refreshing contributes to
  preventing the potential background monitoring. However, it can be
  bypassed. For example, an app can play music in the background without
  turning on its "background app refresh" switch. Thus a
  malicious app can disguise itself as a music app to conduct background monitoring.

Before Apple fixes this issue, the only way for iOS users to avoid
  this security risk is to use the iOS task manager to stop the apps
  from running in the background to prevent potential background
  monitoring. iOS7 users can press the Home button twice to enter the
  task manager and see preview screens of apps opened, and then swipe an
  app up and out of preview to disable unnecessary or suspicious
  applications running on the background, as shown in Fig.3.

We conducted this research independently before we were aware of     href="http://www.ibtimes.co.uk/researcher-creates-malware-captures-every-tap-your-smartphone-or-tablet-1434673">this
    recent report. We hope this blog could help users understand and
  mitigate this threat further.

  Acknowledgement: Special thanks to Jari Salomaa for
  his valuable comments and feedback. We also thank Raymond Wei, Dawn
  Song, and Zheng Bu for their valuable help on writing this blog.

Source: Background Monitoring on Non-Jailbroken iOS 7 Devices -- and a Mitigation