EXIF through a gift shop full of personal data.
In what looks like an Apple oversight, a developer has discovered that apps can access image metadata and therefore a pretty good history of iThing users’ location.
Felix Krause, founder of Fastlane.Tools, reported the issue here and explains that “If an app gets permission to access the image library, it will get full access to all image metadata also, including the exact location.
“This is a serious privacy issue, as third party camera apps that want to just store a picture the user took, will also get full access to all photos and their locations in their image library.”
It’s ridiculously easy to grab user image metadata after that:
```objective-c
PHFetchResult *photos = [PHAsset fetchAssetsWithMediaType:PHAssetMediaTypeImage options:nil];
for (PHAsset *asset in photos) {
if ([asset location]) {
// Access the full location, speed, full picture, camera model, etc. here
}
}
```
In his proof-of-concept at GitHub, Krause explains he “built the initial prototype within under an hour”.
The entire EXIF data set is available to an app with permission to access the image library, so it’s more than just a user’s location. Krause gives the following list:
- The exact location of each asset;
- The physical speed in which the picture/video was taken (how fast did the camera move);
- The camera model;
- The exact date + time; and
- Other exif image metadata.
All of which opens up very rich potential for abuse.
Krause says Apple needs to rework photo permissions, either asking a user to give explicit permission for an app to access image metadata; or to separate out permissions for selecting a photo, and granting access to the photo library.
Source:https://www.theregister.co.uk/2017/09/28/ios_image_metadata_location_leaks/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
