9

As a follow-on to these questions:

What unique fingerprinting information can an iOS7 app collect?

What unique device fingerprinting information can an iOS8 app collect?

Apple has apparently removed the ability to see other running processes in iOS 9, and throttled (and otherwise limited) the ability to test URL schemes. See: https://developer.apple.com/videos/wwdc/2015/?id=703

What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 9, particularly those that have no user controls to block them?

e.g., There is still no official confirmation that "integrated" apps (like Facebook or Twitter) are subject to the above limitations. Both Facebook and Twitter claim that their apps are able to access an app list to use to target ads. Twitter's privacy policy hasn't been updated to state that app graph is unavailable in iOS 9. Also note that this capability is often discussed as "installed and not simply running apps"; see link in this comment for example: What unique device fingerprinting information can an iOS8 app collect?

e.g., There have been apps in the app store that show system information like uptime, battery level, disk size and usage, memory size and usage. These could easily be used as elements of a fingerprinting algorithm in a malicious app or in 3rd-party code in an app.

e.g, as always there is basic system info available similar to what any web page can access: IP address, HTTP headers, etc.

Community
  • 1
pseudon
  • 1,420
  • 9
  • 20
  • Here's one I never expected: apps can apparently use iOS Keychain or iCloud Key-Value Store to save data persistently, even across app deletions and even across all apps from that vendor being deleted, with no user control: http://apple.stackexchange.com/questions/199371/how-does-a-google-ios-app-save-and-restore-active-accounts-across-app-deletion/199397 This essentially allows an app, once installed, to forever uniquely track that device (until the deice is completely wiped). This seems to me to be a very serious security and privacy vulnerability, not just for fingerprinting reasons. – pseudon Aug 09 '15 at 13:58
  • My previous comment also means it is very difficult (requires wiping the device, which is probably not intuitive to most people) to use a device with one account on a service, then later try to use it with a different account on the same service, without the potential for the two accounts to be correlated. – pseudon Jan 31 '16 at 01:03
  • Came across this paper https://www.tu-braunschweig.de/Medien-DB/sec/pubs/2016-pets.pdf which appears to apply to iOS 9 (it mentions several fingerprinting fixes as recent as iOS 8). They list 24 unprotected fingerprinting elements, of varying stability over time. Many have to do with enabled assistive features (e.g., Closed Captioning enabled? boolean). Many seem to catch more unusual circumstances, where most users would appear the same (e.g., Jailbreak? boolean). – pseudon Sep 05 '16 at 22:50
  • The element, Installed Apps (URL Schemes), was mostly addressed in iOS 9 through (I believe) throttling anfdapp review. The most comprehensive remaining elements seem to be: Installed Apps (Icon Cache), Top 50 Songs, and WiFi SSID. Does anyone know if these (or other strong fingerprinting features from the list) are still vulnerabilities in iOS 9? – pseudon Sep 05 '16 at 22:50
  • Top 50 songs AKA access to Media Library, does require user permission in iOS 9, which can be revoked in Settings > Privacy. – pseudon Sep 15 '16 at 17:13

1 Answers1

1

https://panopticlick.eff.org

EFF released a tool to check the uniqueness of a browser through things like canvas etc.

curiously i had never actually run this on iOS, but i just tried it on a device running default browser settings, and it found my browser settings were unique among 175000 tested. apple does not allow non-apple browsers to be based on anything other than their webkit engine. lastly, i am under the impression that all apps have full access to the webkit browser.

there is also a little bit of non-technical info here: https://support.apple.com/en-us/HT205223

infinite-etcetera
  • 760
  • 1
  • 5
  • 10