1,179 karma · joined February 19, 2016
Chief Executive Officer @ Guardian (https://guardianapp.com).
previously: founder of "Chronic Dev Team" & worked on many years of iOS jailbreaking solutions (24kPwn, absinthe, corona, greenpois0n, etc).
The icon, in this case, was a helpful indicator allowing others to easily reproduce this test in minutes.
Relevant to current story: https://twitter.com/chronic/status/1202386593387966464
I am sure many companies in the information security field are doing the same.
It would be nice if there was a simple way to allow anyone with a phone to easily analyze all of their own traffic.
They are freely available for download from Apple.
See here for handy index: https://ipsw.me/
Some of them are designed to be compiled into the (encrypted) main app binary.
They most definitely do not remove such apps.
Use an app like Charles Proxy or Burp Suite to inspect the traffic of your phone when running the “Perfect365” app. It is really remarkable, and Apple is aware of what they are doing.
> Does enabling calendar access suddenly cause Firebase to read the calendar data on its own and report that, too?
These are good questions to be thinking about. As for Firebase specifically, I have never seen it automatically collect additional data based on user-granted permissions (at least in iOS apps).
However, there may be a few other SDKs with this sort of issue. It is important for app developers to be careful of this.
For example, when working on similar location tracking research (see: https://guardianapp.com/research/ios-app-location-report-sep...), I noticed that quite a few prominent apps use an SDK from “Braze” (https://www.braze.com/), and if location permission was granted to the “host” app, the SDK automatically sends back the user’s GPS coordinates when communicating with the Braze API. I remember at least one such app developer had no idea Braze was doing that and rushed a fix out soonafter to make it stop sending the GPS information to Braze.
I hope we see more pressure on analytics companies to offer more open source SDKs instead of compiled binaries and headers. This sort of issue would be easier to spot and deal with, instead of being unsure what exactly the SDK was doing.
To avoid giving the wrong impression to folks, it is worth noting that ‘participating’ means they produced requested communications on an ongoing basis pursuant to orders from a judge.
Designing a reasonably secure and reliable mobile VPN has been a very difficult challenge to get right. If you look at existing mobile VPNs through a tool such as Charles Proxy or Burp, you will see that none of them really appear to be designed very well. There are many unsolved technical problems with managing and scaling such services, likely avoided by existing providers due to how easy the issues are to mask. That said, Cloudflare’s cautious approach with Warp gives me some confidenxe that they really are trying to do this right.
Your linked informational page leaked out when someone sent WikiLeaks a dump from a classified Confluence used by CIA’s cyber folks.
The tool itself, however, had not leaked.
> we let users know exactly what data they will be sending and how we use it
Many apps will just say “see privacy policy” or similar when requesting access. See [1] for examples. That is an approach I would consider dishonest as most users will not try to find and read through it. Does your method use a more explicit consent flow? I think that is a big problem in this space, so you could really differentiate yourselves if informing users in a truly explicit manner unlike others.
[1] https://guardianapp.com/ios-app-location-report-sep2018.html
Many apps do not do pinning currently.
That is precisely what it does. Serving an invalid certificate and requiring user click-through allows for a man in the middle attacker to inject their own certificate without further error and will therefore be able to intercept login credentials.
Hint: You do not need to manually, personally, audit every single line of code to discover the use of such functionality.