SoylentNews is people
SoylentNews
Apple Takes Heat Over 'Vulnerable' iOS Cut-and-Paste Data:
Any cut-and-paste data temporarily stored to an iPhone or iPad's memory can be accessed by all apps installed on the specific device – even malicious ones. That data can then reveal private information such as a user's GPS coordinates, passwords, banking data or a spreadsheet copied into an email.
Shedding light onto the potential harm of this scenario is German software engineer, Tommy Mysk, who is trying to raise awareness around what he believes is an Apple vulnerability. To illustrate his concerns, Mysk created a rogue proof-of-concept (PoC) app called KlipboardSpy and an iOS widget named KlipSpyWidget.
Both are designed to illustrate how any app installed on an iOS device can act maliciously and access clipboard data and use it to spy or steal sensitive personal information. To highlight and demonstrate his concerns, Mysk told Threatpost he focused on photos taken by a device's camera that contain time and GPS metadata that could be used to pinpoint a user.
"A user may unwittingly expose their precise location to apps by simply copying a photo taken by the built-in Camera app to the general pasteboard," the developer wrote in a technical blog post outlining his research on Monday.
"Through the GPS coordinates contained in the embedded image properties, any app used by the user after copying such a photo to the pasteboard can read the location information stored in the image properties, and accurately infer a user's precise location. This can happen completely transparently and without user consent," he wrote.
Apple, in response to his research, said it didn't consider its implementation of cut-and-paste as a vulnerability, rather a basic function of most operating systems and applications that run on them, Mysk told Threatpsot[sic].
Apple did not return Threatpost's request for comment for this story.
(Score: 4, Insightful) by maxwell demon on Thursday February 27 2020, @05:05PM (1 child)
No, that's not necessary. The copy step transfers the data to the OS, which already has complete control anyway. So all that would be needed is that the OS stores not only the copied information, but also which program the information was copied from.
It's only the paste step that would need to be changed. When the application requests a paste, the OS would pop up a dialogue "The application $X requests data from the clipboard that was put there by application $Y$. Do you want to allow the application access to the data?"
The Tao of math: The numbers you can count are not the real numbers.
(Score: 5, Informative) by hendrikboom on Thursday February 27 2020, @11:17PM
It shouldn't be the application that requests the paste. It should be the OS (which is part of the OS) that interprets user actions as a paste and informs the application that the user has designated as the proper recipient. Without being so designated a process should have no access to the paste datum.