So may or may not have known that until recently, the Uber app on your iPhone was able to track and record your screen. Uber has now said that they are going to remove the code from their iOS app so that it can’t record the user’s screen; even when the app is closed.
According to ZDNet, Security researcher, Will Strafach discovered that Uber was given access to a private app permission allowing the app to record the screen. This access is off limits to the majority of developers unless Apple has specifically arranged explicit permissions.
Apps such as iRec use this feature without permission, which runs on jailbroken devices.
Mr Strafach also said, according to ZDNet, that from the thousands of app binaries he’s indexed, the only third-party app that has been given this private app permission, has been Uber, with other iOS developers calling this move a first-time.
Jailbreak and Apple expert Luca Todesco told ZDNet that this permission, known as ‘com.apple.private.allow-explicit-graphics-priority’ in technical terms, allows the app to read and write the device’s framebuffer, which is a part of the device memory that contains pixel and display information. Most apps have the ability to write, but to read the data is where recording the screen comes in, being the equivalent as keylogging on a computer.
This puts a big target on Uber’s app as this feature allows the users’ credentials to be logged by attackers.
According to an Uber spokesman, this feature was added to improve the rendering on the Apple Watch app, so that when the app renders in the background on your phone it can also be sent to your watch.
This is just one of many privacy issues that Uber and its app have had. Previously, Uber was found out to have been tracking drivers of competitor Lyft, as well as tracking iPhones after the user had deleted the app, which led to Apple Chief Executive Tim Cook threatening to kick them off the AppStore.
Do you still have the Uber app on your iPhone? Were you aware of this? Do you think tracking and screen capture is legal and fair in terms of personal privacy and breach of private information? Let us know in the comments below!
